+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public interface AlgorithmMetadata {
/**
* @return the JCA/JCE algorithm name.
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/BinaryFormat.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/BinaryFormat.java
index 1ca933a7f..c570c6599 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/BinaryFormat.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/BinaryFormat.java
@@ -13,8 +13,12 @@
package org.springframework.security.jwt;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public interface BinaryFormat {
byte[] bytes();
}
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/Jwt.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/Jwt.java
index 97b67af47..1e1542a03 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/Jwt.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/Jwt.java
@@ -15,8 +15,12 @@
import org.springframework.security.jwt.crypto.sign.SignatureVerifier;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public interface Jwt extends BinaryFormat {
String getClaims();
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtAlgorithms.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtAlgorithms.java
index cba16c5d0..4ea77b416 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtAlgorithms.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtAlgorithms.java
@@ -18,8 +18,12 @@
import org.springframework.security.jwt.crypto.cipher.CipherMetadata;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public class JwtAlgorithms {
private static final Map sigAlgs = new HashMap();
private static final Map javaToSigAlgs = new HashMap();
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtHelper.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtHelper.java
index b2d192155..04e743efb 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtHelper.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/JwtHelper.java
@@ -29,9 +29,13 @@
import org.springframework.security.jwt.crypto.sign.Signer;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
* @author Dave Syer
*/
+@Deprecated
public class JwtHelper {
static byte[] PERIOD = utf8Encode(".");
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/codec/Codecs.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/codec/Codecs.java
index d2f63894e..28f31c527 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/codec/Codecs.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/codec/Codecs.java
@@ -20,8 +20,12 @@
/**
* Functions for Hex, Base64 and Utf8 encoding/decoding
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public class Codecs {
private static Charset UTF8 = Charset.forName("UTF-8");
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/cipher/CipherMetadata.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/cipher/CipherMetadata.java
index 5e9d107f7..d65e6c2eb 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/cipher/CipherMetadata.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/cipher/CipherMetadata.java
@@ -15,8 +15,12 @@
import org.springframework.security.jwt.AlgorithmMetadata;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public interface CipherMetadata extends AlgorithmMetadata {
/**
* @return Size of the key in bits.
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/EllipticCurveVerifier.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/EllipticCurveVerifier.java
index 38c7bffb9..505d6dafb 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/EllipticCurveVerifier.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/EllipticCurveVerifier.java
@@ -23,9 +23,13 @@
/**
* Verifies signatures using an Elliptic Curve public key.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Michael Duergner
* @since 2.3
*/
+@Deprecated
public class EllipticCurveVerifier implements SignatureVerifier {
private final ECPublicKey key;
private final String algorithm;
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/InvalidSignatureException.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/InvalidSignatureException.java
index be63ca705..6c7ef3e3c 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/InvalidSignatureException.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/InvalidSignatureException.java
@@ -13,8 +13,12 @@
package org.springframework.security.jwt.crypto.sign;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public class InvalidSignatureException extends RuntimeException {
public InvalidSignatureException(String message) {
super(message);
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/MacSigner.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/MacSigner.java
index 2f6c0add2..1aabb2f42 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/MacSigner.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/MacSigner.java
@@ -18,8 +18,12 @@
import javax.crypto.spec.SecretKeySpec;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public class MacSigner implements SignerVerifier {
private static final String DEFAULT_ALGORITHM = "HMACSHA256";
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaKeyHelper.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaKeyHelper.java
index f15862a5e..69a87874c 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaKeyHelper.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaKeyHelper.java
@@ -12,20 +12,23 @@
*/
package org.springframework.security.jwt.crypto.sign;
-import static org.springframework.security.jwt.codec.Codecs.b64Decode;
-import static org.springframework.security.jwt.codec.Codecs.utf8Encode;
+import org.bouncycastle.asn1.ASN1Sequence;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.security.*;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.*;
import java.util.Arrays;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
-import org.bouncycastle.asn1.ASN1Sequence;
+import static org.springframework.security.jwt.codec.Codecs.b64Decode;
+import static org.springframework.security.jwt.codec.Codecs.utf8Encode;
/**
* Reads RSA key pairs using BC provider classes but without the
@@ -72,6 +75,10 @@ static KeyPair parseKeyPair(String pemData) {
org.bouncycastle.asn1.pkcs.RSAPublicKey key = org.bouncycastle.asn1.pkcs.RSAPublicKey.getInstance(seq);
RSAPublicKeySpec pubSpec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());
publicKey = fact.generatePublic(pubSpec);
+ } else if (type.equals("CERTIFICATE")) {
+ CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
+ Certificate certificate = certificateFactory.generateCertificate(new ByteArrayInputStream(content));
+ publicKey = certificate.getPublicKey();
} else {
throw new IllegalArgumentException(type + " is not a supported format");
}
@@ -81,12 +88,15 @@ static KeyPair parseKeyPair(String pemData) {
catch (InvalidKeySpecException e) {
throw new RuntimeException(e);
}
+ catch (CertificateException e) {
+ throw new RuntimeException(e);
+ }
catch (NoSuchAlgorithmException e) {
throw new IllegalStateException(e);
}
}
- private static final Pattern SSH_PUB_KEY = Pattern.compile("ssh-(rsa|dsa) ([A-Za-z0-9/+]+=*) (.*)");
+ private static final Pattern SSH_PUB_KEY = Pattern.compile("ssh-(rsa|dsa) ([A-Za-z0-9/+]+=*) ?(.*)");
static RSAPublicKey parsePublicKey(String key) {
Matcher m = SSH_PUB_KEY.matcher(key);
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaSigner.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaSigner.java
index 04ed3cff5..6439fed67 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaSigner.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaSigner.java
@@ -23,8 +23,12 @@
* The key can be supplied directly, or as an SSH private key string (in
* the standard format produced by ssh-keygen)
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public class RsaSigner implements Signer {
static final String DEFAULT_ALGORITHM = "SHA256withRSA";
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaVerifier.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaVerifier.java
index dc3944d21..0e7cede4c 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaVerifier.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/RsaVerifier.java
@@ -22,8 +22,12 @@
* The key can be supplied directly, or as an SSH public or private key string (in
* the standard format produced by ssh-keygen).
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public class RsaVerifier implements SignatureVerifier {
private final RSAPublicKey key;
private final String algorithm;
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignatureVerifier.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignatureVerifier.java
index a74fc6c88..41253fbae 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignatureVerifier.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignatureVerifier.java
@@ -15,8 +15,12 @@
import org.springframework.security.jwt.AlgorithmMetadata;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public interface SignatureVerifier extends AlgorithmMetadata {
void verify(byte[] content, byte[] signature);
}
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/Signer.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/Signer.java
index 5067e8b6f..ca675671f 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/Signer.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/Signer.java
@@ -15,8 +15,12 @@
import org.springframework.security.jwt.AlgorithmMetadata;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public interface Signer extends AlgorithmMetadata {
byte[] sign(byte[] bytes);
}
diff --git a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignerVerifier.java b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignerVerifier.java
index 3e5307438..d75dd5f7e 100644
--- a/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignerVerifier.java
+++ b/spring-security-jwt/src/main/java/org/springframework/security/jwt/crypto/sign/SignerVerifier.java
@@ -13,7 +13,11 @@
package org.springframework.security.jwt.crypto.sign;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Luke Taylor
*/
+@Deprecated
public interface SignerVerifier extends Signer, SignatureVerifier {
}
diff --git a/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/cipher/RsaTestKeyData.java b/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/cipher/RsaTestKeyData.java
index b0901127d..5efbfe88d 100644
--- a/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/cipher/RsaTestKeyData.java
+++ b/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/cipher/RsaTestKeyData.java
@@ -97,6 +97,12 @@ public class RsaTestKeyData {
+ "eJQ4nUR0pkfEaeRWOmzWE/3wC9DHoSmYoTF7B3gwyPvuBFgB5KjSk+G6AuubLkMs+jFJQZJkQcI+UJ859MC3024ThjBukLAN8OZBv7"
+ "2d6rtDQ/Ca0/qMWtXhVneKvZxZg5MXoVwvtkidwbdoK9fGnylRDs0+KZh3vR0Q+67V blah@blah.local";
+ public static final String SSH_PUBLIC_KEY_STRING_WITHOUT_COMMENT = "ssh-rsa "
+ + "AAAAB3NzaC1yc2EAAAADAQABAAABAQDABE3hLtnRqxISPrX5Ii+1RS4eil399+d7UJtodc3GP9wjitjSTkQtnZIYIVWCbH1cAMkmFi"
+ + "hAiY768zEUCptbHI7jkHWtlHWrQKEQVYsY+Y0H59jxOsUciMlvzvezR3YVNgM7Cy3od0o+NeQt2AYc7grV8uc7VxAcoaCUEq9zhlJW"
+ + "eJQ4nUR0pkfEaeRWOmzWE/3wC9DHoSmYoTF7B3gwyPvuBFgB5KjSk+G6AuubLkMs+jFJQZJkQcI+UJ859MC3024ThjBukLAN8OZBv7"
+ + "2d6rtDQ/Ca0/qMWtXhVneKvZxZg5MXoVwvtkidwbdoK9fGnylRDs0+KZh3vR0Q+67V";
+
public static final String SSH_PUBLIC_KEY_OPENSSL_PEM_STRING = "-----BEGIN PUBLIC KEY-----\n" +
"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwARN4S7Z0asSEj61+SIv\n" +
@@ -117,4 +123,24 @@ public class RsaTestKeyData {
"L7ZIncG3aCvXxp8pUQ7NPimYd70dEPuu1QIDAQAB\n" +
"-----END RSA PUBLIC KEY-----";
+ public static final String SSH_X509_CERTIFICATE_PEM_STRING = "-----BEGIN CERTIFICATE-----\n" +
+ "MIIDHDCCAgSgAwIBAgIJAK+wnYpjtdVFMA0GCSqGSIb3DQEBCwUAMCMxITAfBgNV\n" +
+ "BAMMGHNwcmluZy1zZWN1cml0eS1qd3QtdGVzdDAeFw0xODA0MTcwOTQ4MzVaFw0x\n" +
+ "ODA1MTcwOTQ4MzVaMCMxITAfBgNVBAMMGHNwcmluZy1zZWN1cml0eS1qd3QtdGVz\n" +
+ "dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMAETeEu2dGrEhI+tfki\n" +
+ "L7VFLh6KXf3353tQm2h1zcY/3COK2NJORC2dkhghVYJsfVwAySYWKECJjvrzMRQK\n" +
+ "m1scjuOQda2UdatAoRBVixj5jQfn2PE6xRyIyW/O97NHdhU2AzsLLeh3Sj415C3Y\n" +
+ "BhzuCtXy5ztXEByhoJQSr3OGUlZ4lDidRHSmR8Rp5FY6bNYT/fAL0MehKZihMXsH\n" +
+ "eDDI++4EWAHkqNKT4boC65suQyz6MUlBkmRBwj5Qnzn0wLfTbhOGMG6QsA3w5kG/\n" +
+ "vZ3qu0ND8JrT+oxa1eFWd4q9nFmDkxehXC+2SJ3Bt2gr18afKVEOzT4pmHe9HRD7\n" +
+ "rtUCAwEAAaNTMFEwHQYDVR0OBBYEFPM7mHoBTz7Bgyblen9oSqd6gCVTMB8GA1Ud\n" +
+ "IwQYMBaAFPM7mHoBTz7Bgyblen9oSqd6gCVTMA8GA1UdEwEB/wQFMAMBAf8wDQYJ\n" +
+ "KoZIhvcNAQELBQADggEBAGfx6+D8YpYVHYbB9mdUDVmFKEq3rFBKaHXL8fDceHUi\n" +
+ "GOAG0dLqP+lxx/pPsgfW8dnu1h/I5+cvOsj/YmwLMlodhrGN0XpaWmATz7+ikif3\n" +
+ "VGGNXIWl/km+r30M4diFnSnycjYaOJdBqhLIkQd/w/JFFJ5J+C5b2281jYGw6Y1F\n" +
+ "Kq3pqLlQVCnQhcnDroCtwLK78hG7yZasYVBnjKilSkMB1k14Kfq8WUR3NsODRiXg\n" +
+ "EP+KsWrwS5l/cyUzkWDKgOvmlWeqSWp95WGhewuVAs34W0hzdT3JDd4TIX3NWMuw\n" +
+ "i9txCbagsrq/2+rKgsasCPlcQwFw6Umzd73HuqiHmoM=\n" +
+ "-----END CERTIFICATE-----\n";
+
}
diff --git a/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/sign/RsaSigningTests.java b/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/sign/RsaSigningTests.java
index 27e8dbb46..da83c9bc3 100644
--- a/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/sign/RsaSigningTests.java
+++ b/spring-security-jwt/src/test/java/org/springframework/security/jwt/crypto/sign/RsaSigningTests.java
@@ -12,12 +12,12 @@
*/
package org.springframework.security.jwt.crypto.sign;
-import static org.junit.Assert.assertNotNull;
-
import org.junit.Test;
import org.springframework.security.jwt.codec.Codecs;
import org.springframework.security.jwt.crypto.cipher.RsaTestKeyData;
+import static org.junit.Assert.assertNotNull;
+
/**
* @author Luke Taylor
*/
@@ -35,6 +35,12 @@ public void rsaSignerValidKeyWithWhitespace() throws Exception {
assertNotNull(signer);
}
+ @Test
+ public void rsaVerifierValidKeyWithoutComment() throws Exception {
+ RsaVerifier verifier = new RsaVerifier(RsaTestKeyData.SSH_PUBLIC_KEY_STRING_WITHOUT_COMMENT);
+ assertNotNull(verifier);
+ }
+
@Test
public void keysFromPrivateAndPublicKeyStringDataAreCorrect() throws Exception {
// Do a test sign and verify
@@ -56,5 +62,8 @@ public void keysFromPrivateAndPublicKeyStringDataAreCorrect() throws Exception {
verifier = new RsaVerifier(RsaTestKeyData.SSH_PUBLIC_KEY_OPENSSL_PEM_STRING);
verifier.verify(content, signed);
+
+ verifier = new RsaVerifier(RsaTestKeyData.SSH_X509_CERTIFICATE_PEM_STRING);
+ verifier.verify(content, signed);
}
}
diff --git a/spring-security-oauth/pom.xml b/spring-security-oauth/pom.xml
index 2adee4f91..7ea72e61d 100644
--- a/spring-security-oauth/pom.xml
+++ b/spring-security-oauth/pom.xml
@@ -4,7 +4,7 @@
org.springframework.security.oauthspring-security-oauth-parent
- 2.3.8.BUILD-SNAPSHOT
+ 2.5.3.BUILD-SNAPSHOTspring-security-oauth
@@ -169,7 +169,7 @@
org.apache.httpcomponentshttpclient
- 4.5.10
+ 4.5.13
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthCodec.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthCodec.java
index 0e917b772..393f6c3e2 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthCodec.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthCodec.java
@@ -25,8 +25,12 @@
/**
* Utility for parameter encoding according to the OAuth spec.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthCodec extends URLCodec {
protected static final BitSet SAFE_CHARACTERS = (BitSet) URLCodec.WWW_FORM_URL.clone();
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthConsumerParameter.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthConsumerParameter.java
index 91127a909..66e6bc1f5 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthConsumerParameter.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthConsumerParameter.java
@@ -19,8 +19,12 @@
/**
* Enumeration for consumer parameters.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public enum OAuthConsumerParameter {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthException.java
index fc6e727a5..9c8b44a6a 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthException.java
@@ -20,10 +20,14 @@
/**
* Base exception for OAuth processing.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class OAuthException extends AuthenticationException {
public OAuthException(String message) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthProviderParameter.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthProviderParameter.java
index fdcd0ceae..af5c8be4d 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthProviderParameter.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/OAuthProviderParameter.java
@@ -19,8 +19,12 @@
/**
* Parameters that can be used by the provider.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public enum OAuthProviderParameter {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/StringSplitUtils.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/StringSplitUtils.java
index 87ed8e914..e2a2045c9 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/StringSplitUtils.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/StringSplitUtils.java
@@ -10,7 +10,12 @@
/**
* Provides several String manipulation methods. Copied from deleted org.springframework.security.util.StringSplitUtils
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
*/
+@Deprecated
public class StringSplitUtils {
private static final String[] EMPTY_STRING_ARRAY = new String[0];
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/CoreOAuthSignatureMethodFactory.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/CoreOAuthSignatureMethodFactory.java
index 0e736d7b1..b8abb0940 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/CoreOAuthSignatureMethodFactory.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/CoreOAuthSignatureMethodFactory.java
@@ -30,8 +30,12 @@
/**
* Implements the signatures defined in OAuth Core 1.0. By default, PLAINTEXT signatures are not supported
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class CoreOAuthSignatureMethodFactory implements OAuthSignatureMethodFactory {
private boolean supportPlainText = false;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/HMAC_SHA1SignatureMethod.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/HMAC_SHA1SignatureMethod.java
index 6fb680f6b..baf4c0b52 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/HMAC_SHA1SignatureMethod.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/HMAC_SHA1SignatureMethod.java
@@ -29,8 +29,12 @@
/**
* HMAC-SHA1 signature method.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class HMAC_SHA1SignatureMethod implements OAuthSignatureMethod {
private static final Log LOG = LogFactory.getLog(HMAC_SHA1SignatureMethod.class);
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/InvalidSignatureException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/InvalidSignatureException.java
index 260bee365..0ff6d2cb5 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/InvalidSignatureException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/InvalidSignatureException.java
@@ -21,9 +21,13 @@
/**
* Thrown when a signature is invalid.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidSignatureException extends OAuthException {
public InvalidSignatureException(String msg) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethod.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethod.java
index 348684003..883439681 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethod.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethod.java
@@ -17,8 +17,12 @@
package org.springframework.security.oauth.common.signature;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthSignatureMethod {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethodFactory.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethodFactory.java
index 00f015391..7aed490ca 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethodFactory.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/OAuthSignatureMethodFactory.java
@@ -19,8 +19,12 @@
/**
* Factory for signature methods.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthSignatureMethodFactory {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/PlainTextSignatureMethod.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/PlainTextSignatureMethod.java
index 31e6eae7d..673b24f60 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/PlainTextSignatureMethod.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/PlainTextSignatureMethod.java
@@ -21,8 +21,12 @@
/**
* Plain text signature method.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class PlainTextSignatureMethod implements OAuthSignatureMethod {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSAKeySecret.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSAKeySecret.java
index 21b49bcd1..e4c1d8a68 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSAKeySecret.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSAKeySecret.java
@@ -32,9 +32,13 @@
/**
* Signature secret for RSA.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class RSAKeySecret implements SignatureSecret {
private final PrivateKey privateKey;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSA_SHA1SignatureMethod.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSA_SHA1SignatureMethod.java
index 0c6a6cec9..f027f84df 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSA_SHA1SignatureMethod.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/RSA_SHA1SignatureMethod.java
@@ -25,8 +25,12 @@
* RSA-SHA1 signature method. The RSA-SHA1 signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in RFC3447
* section 8.2 (more simply known as PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class RSA_SHA1SignatureMethod implements OAuthSignatureMethod {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SaltedConsumerSecret.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SaltedConsumerSecret.java
index 7b5250506..ad433b5f5 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SaltedConsumerSecret.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SaltedConsumerSecret.java
@@ -3,8 +3,12 @@
/**
* Marker interface for indicating that a consumer secret has some salt.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface SaltedConsumerSecret {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecret.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecret.java
index e2b4accdc..ef627ccf3 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecret.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecret.java
@@ -19,9 +19,13 @@
/**
* A signature secret that consists of a consumer secret and a token secret.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Aliaksandr Autayeu
*/
+@Deprecated
public interface SharedConsumerSecret extends SignatureSecret {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecretImpl.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecretImpl.java
index dff207c00..6eb66901f 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecretImpl.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SharedConsumerSecretImpl.java
@@ -19,9 +19,13 @@
/**
* Default implementation of a signature secret.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class SharedConsumerSecretImpl implements SharedConsumerSecret {
private final String consumerSecret;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecret.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecret.java
index 8110de2a9..44cde648b 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecret.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecret.java
@@ -20,9 +20,13 @@
/**
* Marker interface for OAuth signature secrets.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public interface SignatureSecret extends Serializable {
}
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecretEditor.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecretEditor.java
index 7702c508d..874e3624b 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecretEditor.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/SignatureSecretEditor.java
@@ -20,9 +20,13 @@
/**
* A signature secret that consists of a consumer secret and a tokent secret.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class SignatureSecretEditor extends PropertyEditorSupport {
public void setAsText(String text) throws IllegalArgumentException {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/UnsupportedSignatureMethodException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/UnsupportedSignatureMethodException.java
index 88f1a4782..be7852485 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/UnsupportedSignatureMethodException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/common/signature/UnsupportedSignatureMethodException.java
@@ -17,9 +17,13 @@
package org.springframework.security.oauth.common.signature;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UnsupportedSignatureMethodException extends RuntimeException {
public UnsupportedSignatureMethodException(String msg) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConfigUtils.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConfigUtils.java
index 7d5e17c96..2922fad7e 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConfigUtils.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConfigUtils.java
@@ -23,8 +23,12 @@
/**
* Common place for OAuth namespace configuration utils.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class ConfigUtils {
private static final Method createMatcherMethod3x = ReflectionUtils.findMethod(
MatcherType.class, "createMatcher", String.class, String.class);
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerDetailsFactoryBean.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerDetailsFactoryBean.java
index 50f29b4ac..ad3c1e247 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerDetailsFactoryBean.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerDetailsFactoryBean.java
@@ -32,9 +32,13 @@
import org.springframework.security.oauth.provider.ConsumerDetails;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ConsumerDetailsFactoryBean implements FactoryBean, ResourceLoaderAware {
private static final Log logger = LogFactory.getLog(ConsumerDetailsFactoryBean.class);
@@ -92,14 +96,14 @@ public ConsumerDetails getObject() throws Exception {
consumer.setSignatureSecret(new RSAKeySecret(cert.getPublicKey()));
}
catch (IOException e) {
- throw new BeanCreationException("RSA certificate not found at " + secret + ".",
+ throw new BeanCreationException("RSA certificate not found",
e);
}
catch (CertificateException e) {
- throw new BeanCreationException("Invalid RSA certificate at " + secret + ".", e);
+ throw new BeanCreationException("Invalid RSA certificate", e);
}
catch (NullPointerException e) {
- throw new BeanCreationException("Could not load RSA certificate at " + secret + ".", e);
+ throw new BeanCreationException("Could not load RSA certificate", e);
}
finally {
try {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerServiceBeanDefinitionParser.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerServiceBeanDefinitionParser.java
index d8cfba0d1..3f03de13c 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerServiceBeanDefinitionParser.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ConsumerServiceBeanDefinitionParser.java
@@ -29,10 +29,14 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
* @author Dave Syer
*/
+@Deprecated
public class ConsumerServiceBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ExpressionHandlerBeanDefinitionParser.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ExpressionHandlerBeanDefinitionParser.java
index 30e4118ac..0bc457f54 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ExpressionHandlerBeanDefinitionParser.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ExpressionHandlerBeanDefinitionParser.java
@@ -21,9 +21,13 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class ExpressionHandlerBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthConsumerBeanDefinitionParser.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthConsumerBeanDefinitionParser.java
index 004fc87d5..c984e495a 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthConsumerBeanDefinitionParser.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthConsumerBeanDefinitionParser.java
@@ -34,10 +34,14 @@
/**
* Parser for the OAuth "consumer" element.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
* @author Luke Taylor
*/
+@Deprecated
public class OAuthConsumerBeanDefinitionParser implements BeanDefinitionParser {
public BeanDefinition parse(Element element, ParserContext parserContext) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthProviderBeanDefinitionParser.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthProviderBeanDefinitionParser.java
index 5a1873e8c..6b1721050 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthProviderBeanDefinitionParser.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthProviderBeanDefinitionParser.java
@@ -39,9 +39,13 @@
/**
* Parser for the OAuth "provider" element.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
+@Deprecated
public class OAuthProviderBeanDefinitionParser implements BeanDefinitionParser {
public BeanDefinition parse(Element element, ParserContext parserContext) {
@@ -203,7 +207,7 @@ private int insertIndex(List filterChain) {
BeanMetadataElement filter = filterChain.get(i);
if (filter instanceof BeanDefinition) {
String beanName = ((BeanDefinition) filter).getBeanClassName();
- if (beanName.equals(ExceptionTranslationFilter.class.getName())) {
+ if (ExceptionTranslationFilter.class.getName().equals(beanName)) {
return i + 1;
}
}
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthSecurityNamespaceHandler.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthSecurityNamespaceHandler.java
index 91cdaba92..f45565316 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthSecurityNamespaceHandler.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/OAuthSecurityNamespaceHandler.java
@@ -19,8 +19,12 @@
import org.springframework.beans.factory.xml.NamespaceHandlerSupport;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthSecurityNamespaceHandler extends NamespaceHandlerSupport {
public void init() {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsBeanDefinitionParser.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsBeanDefinitionParser.java
index ac4cdb905..4e77bbc56 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsBeanDefinitionParser.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsBeanDefinitionParser.java
@@ -31,8 +31,12 @@
import java.util.Map;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class ProtectedResourceDetailsBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsServiceFactoryBean.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsServiceFactoryBean.java
index 81fe4856f..e10b20015 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsServiceFactoryBean.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/ProtectedResourceDetailsServiceFactoryBean.java
@@ -12,8 +12,12 @@
/**
* Factory bean for the resource details service.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class ProtectedResourceDetailsServiceFactoryBean extends AbstractFactoryBean {
@Override
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/TokenServiceBeanDefinitionParser.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/TokenServiceBeanDefinitionParser.java
index 784a69790..a63e08ade 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/TokenServiceBeanDefinitionParser.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/TokenServiceBeanDefinitionParser.java
@@ -24,8 +24,12 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class TokenServiceBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/VerifierServiceBeanDefinitionParser.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/VerifierServiceBeanDefinitionParser.java
index 8f85b150a..d280e5c3d 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/VerifierServiceBeanDefinitionParser.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/config/VerifierServiceBeanDefinitionParser.java
@@ -24,8 +24,12 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class VerifierServiceBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/AccessTokenRequiredException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/AccessTokenRequiredException.java
index c93385391..715973b2d 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/AccessTokenRequiredException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/AccessTokenRequiredException.java
@@ -3,9 +3,13 @@
import org.springframework.security.authentication.InsufficientAuthenticationException;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class AccessTokenRequiredException extends InsufficientAuthenticationException {
private final ProtectedResourceDetails resource;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/BaseProtectedResourceDetails.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/BaseProtectedResourceDetails.java
index 7a35df339..53059dda2 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/BaseProtectedResourceDetails.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/BaseProtectedResourceDetails.java
@@ -24,8 +24,12 @@
/**
* Basic implementation of protected resource details.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class BaseProtectedResourceDetails implements ProtectedResourceDetails {
private String id;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InMemoryProtectedResourceDetailsService.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InMemoryProtectedResourceDetailsService.java
index 3d50987c2..a0c188114 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InMemoryProtectedResourceDetailsService.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InMemoryProtectedResourceDetailsService.java
@@ -22,8 +22,12 @@
/**
* Basic, in-memory implementation of a protected resource details service.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class InMemoryProtectedResourceDetailsService implements ProtectedResourceDetailsService {
private Map resourceDetailsStore = new HashMap();
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InvalidOAuthRealmException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InvalidOAuthRealmException.java
index 4dfd1c010..8da4d544d 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InvalidOAuthRealmException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/InvalidOAuthRealmException.java
@@ -18,10 +18,14 @@
/**
* Thrown when a different realm appears to be the cause of the authorization failure.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidOAuthRealmException extends OAuthRequestFailedException {
private final String requiredRealm;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerSupport.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerSupport.java
index fda9d13b5..4ae98786f 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerSupport.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerSupport.java
@@ -24,8 +24,12 @@
/**
* Consumer-side support for OAuth.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthConsumerSupport {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerToken.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerToken.java
index 6472e24f5..1e93577b5 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerToken.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthConsumerToken.java
@@ -21,9 +21,13 @@
/**
* Interface for a consumer-side OAuth token.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthConsumerToken implements Serializable {
private static final long serialVersionUID = -4057986970456346647L;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthRequestFailedException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthRequestFailedException.java
index 1e914cb36..60c735d05 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthRequestFailedException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthRequestFailedException.java
@@ -21,9 +21,13 @@
/**
* Thrown when an OAuth request fails.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class OAuthRequestFailedException extends AccessDeniedException {
public OAuthRequestFailedException(String msg) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContext.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContext.java
index 3a5ce0789..7e2a5e34e 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContext.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContext.java
@@ -6,8 +6,12 @@
/**
* The OAuth 2 security context (for a specific user).
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthSecurityContext {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextHolder.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextHolder.java
index 6ed43ad66..f61b05497 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextHolder.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextHolder.java
@@ -3,8 +3,12 @@
/**
* Holder for the current OAuth security context.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthSecurityContextHolder {
private static final ThreadLocal CURRENT_CONTEXT = new ThreadLocal();
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextImpl.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextImpl.java
index 176240897..9a05d76b3 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextImpl.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/OAuthSecurityContextImpl.java
@@ -4,8 +4,12 @@
import java.util.Map;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthSecurityContextImpl implements OAuthSecurityContext {
private Map accessTokens;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetails.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetails.java
index 9e8ac672d..901137d4a 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetails.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetails.java
@@ -23,9 +23,13 @@
/**
* Details about a protected resource.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
+@Deprecated
public interface ProtectedResourceDetails {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetailsService.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetailsService.java
index f690fc042..a6c6037aa 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetailsService.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/ProtectedResourceDetailsService.java
@@ -19,8 +19,12 @@
/**
* Service for loading protected resource details.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface ProtectedResourceDetailsService {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/UnverifiedRequestTokenException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/UnverifiedRequestTokenException.java
index 876f8c674..68cd47791 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/UnverifiedRequestTokenException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/UnverifiedRequestTokenException.java
@@ -19,9 +19,13 @@
/**
* Thrown when an attempt is made to use an unverified request token.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UnverifiedRequestTokenException extends OAuthRequestFailedException {
public UnverifiedRequestTokenException(String msg) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/CoreOAuthConsumerSupport.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/CoreOAuthConsumerSupport.java
index 65703bab5..cfec33cc0 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/CoreOAuthConsumerSupport.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/CoreOAuthConsumerSupport.java
@@ -52,9 +52,13 @@
* OAuth provider. A proxy will be selected, but it is assumed that the {@link javax.net.ssl.TrustManager}s
* and other connection-related environment variables are already set up.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
+@Deprecated
public class CoreOAuthConsumerSupport implements OAuthConsumerSupport, InitializingBean {
private static final Log logger = LogFactory.getLog(CoreOAuthConsumerSupport.class);
@@ -134,7 +138,7 @@ public OAuthConsumerToken getAccessToken(ProtectedResourceDetails details, OAuth
Map additionalParameters = new TreeMap();
if (details.isUse10a()) {
if (verifier == null) {
- throw new UnverifiedRequestTokenException("Unverified request token: " + requestToken);
+ throw new UnverifiedRequestTokenException("Unverified request token");
}
additionalParameters.put(OAuthConsumerParameter.oauth_verifier.toString(), verifier);
}
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthClientHttpRequestFactory.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthClientHttpRequestFactory.java
index 1f00bf42d..d7015365c 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthClientHttpRequestFactory.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthClientHttpRequestFactory.java
@@ -20,8 +20,12 @@
/**
* Request factory that extends all http requests with the OAuth credentials for a specific protected resource.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthClientHttpRequestFactory implements ClientHttpRequestFactory {
private final ClientHttpRequestFactory delegate;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthRestTemplate.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthRestTemplate.java
index 0d2e6b1fe..59d323394 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthRestTemplate.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/client/OAuthRestTemplate.java
@@ -9,8 +9,12 @@
/**
* Rest template that is able to make OAuth-authenticated REST requests with the credentials of the provided resource.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthRestTemplate extends RestTemplate {
private final ProtectedResourceDetails resource;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerContextFilter.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerContextFilter.java
index 776750baa..5d8612fa0 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerContextFilter.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerContextFilter.java
@@ -65,8 +65,12 @@
/**
* OAuth filter that establishes an OAuth security context.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthConsumerContextFilter implements Filter, InitializingBean, MessageSourceAware {
public static final String ACCESS_TOKENS_DEFAULT_ATTRIBUTE = "OAUTH_ACCESS_TOKENS";
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerProcessingFilter.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerProcessingFilter.java
index 4a38aeecb..29674ce68 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerProcessingFilter.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/filter/OAuthConsumerProcessingFilter.java
@@ -53,9 +53,13 @@
* When servicing a request that requires protected resources, this filter sets a request attribute (default "OAUTH_ACCESS_TOKENS") that contains
* the list of {@link org.springframework.security.oauth.consumer.OAuthConsumerToken}s.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
+@Deprecated
public class OAuthConsumerProcessingFilter implements Filter, InitializingBean, MessageSourceAware {
private static final Log LOG = LogFactory.getLog(OAuthConsumerProcessingFilter.class);
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/DefaultOAuthURLStreamHandlerFactory.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/DefaultOAuthURLStreamHandlerFactory.java
index b7b242900..db424e879 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/DefaultOAuthURLStreamHandlerFactory.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/DefaultOAuthURLStreamHandlerFactory.java
@@ -26,8 +26,12 @@
/**
* Default implementation. Assumes we're running on Sun's JVM.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class DefaultOAuthURLStreamHandlerFactory implements OAuthURLStreamHandlerFactory {
public URLStreamHandler getHttpStreamHandler(ProtectedResourceDetails resourceDetails, OAuthConsumerToken accessToken, OAuthConsumerSupport support, String httpMethod, Map additionalParameters) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpURLStreamHandler.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpURLStreamHandler.java
index 321d27fea..055981f69 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpURLStreamHandler.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpURLStreamHandler.java
@@ -30,9 +30,13 @@
/**
* Stream handler to handle the request stream to a protected resource over HTTP.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("restriction")
+@Deprecated
public class OAuthOverHttpURLStreamHandler extends sun.net.www.protocol.http.Handler {
private final ProtectedResourceDetails resourceDetails;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpsURLStreamHandler.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpsURLStreamHandler.java
index 1f1dc3159..7646b0f5b 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpsURLStreamHandler.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthOverHttpsURLStreamHandler.java
@@ -30,9 +30,13 @@
/**
* Stream handler to handle the request stream to a protected resource over HTTP.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("restriction")
+@Deprecated
public class OAuthOverHttpsURLStreamHandler extends sun.net.www.protocol.https.Handler {
private final ProtectedResourceDetails resourceDetails;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthURLStreamHandlerFactory.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthURLStreamHandlerFactory.java
index 022d4719b..b34172184 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthURLStreamHandlerFactory.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/net/OAuthURLStreamHandlerFactory.java
@@ -26,8 +26,12 @@
/**
* Factory for a OAuth URL stream handlers.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthURLStreamHandlerFactory {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/NonceFactory.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/NonceFactory.java
index fa8315175..208190451 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/NonceFactory.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/NonceFactory.java
@@ -19,8 +19,12 @@
/**
* A nonce factory.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface NonceFactory {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/UUIDNonceFactory.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/UUIDNonceFactory.java
index ca22d5dca..af5906ad3 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/UUIDNonceFactory.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/nonce/UUIDNonceFactory.java
@@ -21,8 +21,12 @@
/**
* Nonce factory that uses a UUID to generate the nonce.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class UUIDNonceFactory implements NonceFactory {
public String generateNonce() {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/HttpSessionOAuthRememberMeServices.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/HttpSessionOAuthRememberMeServices.java
index bc218993d..b7b8a5fc1 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/HttpSessionOAuthRememberMeServices.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/HttpSessionOAuthRememberMeServices.java
@@ -12,10 +12,14 @@
/**
* Default implementation of the OAuth2 rememberme services. Just stores everything in the session by default. Storing
* access token can be suppressed to reduce long-term expose of these tokens in the underlying HTTP session.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Alex Rau
*/
+@Deprecated
public class HttpSessionOAuthRememberMeServices implements OAuthRememberMeServices {
public static final String REMEMBERED_TOKENS_KEY = HttpSessionOAuthRememberMeServices.class.getName()
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/NoOpOAuthRememberMeServices.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/NoOpOAuthRememberMeServices.java
index 0d08b2513..4eb6e8e9a 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/NoOpOAuthRememberMeServices.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/NoOpOAuthRememberMeServices.java
@@ -10,9 +10,13 @@
* Basic, no-op implementation of the remember-me services. Not very useful in a 3-legged OAuth flow, but for a 2-legged
* system where there are no request tokens to store in between requests it keeps the consumer stateless at the price of
* obtaining a new access token for every request.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class NoOpOAuthRememberMeServices implements OAuthRememberMeServices {
public Map loadRememberedTokens(HttpServletRequest request, HttpServletResponse response) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/OAuthRememberMeServices.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/OAuthRememberMeServices.java
index 905367c14..f68e45448 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/OAuthRememberMeServices.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/rememberme/OAuthRememberMeServices.java
@@ -9,8 +9,12 @@
/**
* Services for "remembering" the access tokens that have been obtained.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthRememberMeServices {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/HttpSessionBasedTokenServices.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/HttpSessionBasedTokenServices.java
index 9f488a0c8..847a212c3 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/HttpSessionBasedTokenServices.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/HttpSessionBasedTokenServices.java
@@ -27,8 +27,12 @@
/**
* Stores the tokens in an HTTP session.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class HttpSessionBasedTokenServices implements OAuthConsumerTokenServices {
public static final String KEY_PREFIX = "OAUTH_TOKEN";
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/OAuthConsumerTokenServices.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/OAuthConsumerTokenServices.java
index a97c11a8b..40422998f 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/OAuthConsumerTokenServices.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/consumer/token/OAuthConsumerTokenServices.java
@@ -21,9 +21,13 @@
/**
* Token services for an OAuth consumer.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthConsumerTokenServices {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/BaseConsumerDetails.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/BaseConsumerDetails.java
index 2f4a402ef..003bfb096 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/BaseConsumerDetails.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/BaseConsumerDetails.java
@@ -25,10 +25,14 @@
/**
* Base implementation for consumer details.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
@SuppressWarnings("serial")
+@Deprecated
public class BaseConsumerDetails implements ResourceSpecificConsumerDetails, ExtraTrustConsumerDetails {
private String consumerKey;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerAuthentication.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerAuthentication.java
index 3246e7e63..42597b46a 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerAuthentication.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerAuthentication.java
@@ -22,10 +22,14 @@
/**
* Authentication for an OAuth consumer.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class ConsumerAuthentication extends AbstractAuthenticationToken {
private final ConsumerDetails consumerDetails;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerCredentials.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerCredentials.java
index 48b983954..8c09f2926 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerCredentials.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerCredentials.java
@@ -21,9 +21,13 @@
/**
* The credentials for an OAuth consumer request.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class ConsumerCredentials implements Serializable {
private final String consumerKey;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetails.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetails.java
index 9756f19fa..a72b18fb5 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetails.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetails.java
@@ -25,8 +25,12 @@
/**
* Provides core OAuth consumer information.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface ConsumerDetails extends Serializable {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetailsService.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetailsService.java
index 41c52a421..76031a77f 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetailsService.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ConsumerDetailsService.java
@@ -21,8 +21,12 @@
/**
* A service that provides the details about an oauth consumer.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface ConsumerDetailsService {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/DefaultAuthenticationHandler.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/DefaultAuthenticationHandler.java
index d1ad40eda..dfda4d254 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/DefaultAuthenticationHandler.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/DefaultAuthenticationHandler.java
@@ -9,8 +9,12 @@
/**
* The default authentication handler.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class DefaultAuthenticationHandler implements OAuthAuthenticationHandler {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ExtraTrustConsumerDetails.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ExtraTrustConsumerDetails.java
index 4e5cd0d4c..7ec33d13b 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ExtraTrustConsumerDetails.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ExtraTrustConsumerDetails.java
@@ -19,8 +19,12 @@
/**
* Consumer details for a specific resource.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface ExtraTrustConsumerDetails extends ConsumerDetails {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InMemoryConsumerDetailsService.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InMemoryConsumerDetailsService.java
index f8dc7cbd0..32be99d0c 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InMemoryConsumerDetailsService.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InMemoryConsumerDetailsService.java
@@ -24,8 +24,12 @@
/**
* Basic, in-memory implementation of the consumer details service.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class InMemoryConsumerDetailsService implements ConsumerDetailsService {
private Map consumerDetailsStore = new HashMap();
@@ -33,7 +37,7 @@ public class InMemoryConsumerDetailsService implements ConsumerDetailsService {
public ConsumerDetails loadConsumerByConsumerKey(String consumerKey) throws OAuthException {
ConsumerDetails details = consumerDetailsStore.get(consumerKey);
if (details == null) {
- throw new InvalidOAuthParametersException("Consumer not found: " + consumerKey);
+ throw new InvalidOAuthParametersException("Consumer not found");
}
return details;
}
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InvalidOAuthParametersException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InvalidOAuthParametersException.java
index de4753471..c26d3e776 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InvalidOAuthParametersException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/InvalidOAuthParametersException.java
@@ -19,9 +19,13 @@
import org.springframework.security.oauth.common.OAuthException;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidOAuthParametersException extends OAuthException {
public InvalidOAuthParametersException(String msg) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationDetails.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationDetails.java
index 58ee7ee59..c7a9d4de0 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationDetails.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationDetails.java
@@ -22,10 +22,14 @@
/**
* Authentication details and includes the details of the OAuth consumer.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class OAuthAuthenticationDetails extends WebAuthenticationDetails {
private final ConsumerDetails consumerDetails;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationHandler.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationHandler.java
index d0c277bb6..408a4b9c9 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationHandler.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthAuthenticationHandler.java
@@ -8,8 +8,12 @@
/**
* Callback interface for handing authentication details that are used when an authenticated request for a protected resource is received.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthAuthenticationHandler {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProcessingFilterEntryPoint.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProcessingFilterEntryPoint.java
index 8125ad077..9ce9becc1 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProcessingFilterEntryPoint.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProcessingFilterEntryPoint.java
@@ -28,8 +28,12 @@
/**
* Entry point for OAuth authentication requests.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuthProcessingFilterEntryPoint implements AuthenticationEntryPoint {
private String realmName;
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProviderSupport.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProviderSupport.java
index c44e0a177..6817bea5c 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProviderSupport.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthProviderSupport.java
@@ -21,9 +21,13 @@
/**
* Support logic for OAuth providers.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface OAuthProviderSupport {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthVersionUnsupportedException.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthVersionUnsupportedException.java
index ea6a20eca..aabf1722b 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthVersionUnsupportedException.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/OAuthVersionUnsupportedException.java
@@ -17,9 +17,13 @@
package org.springframework.security.oauth.provider;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class OAuthVersionUnsupportedException extends InvalidOAuthParametersException {
public OAuthVersionUnsupportedException(String msg) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ResourceSpecificConsumerDetails.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ResourceSpecificConsumerDetails.java
index 0622281dc..474a5126a 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ResourceSpecificConsumerDetails.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/ResourceSpecificConsumerDetails.java
@@ -19,8 +19,12 @@
/**
* Consumer details for a specific resource.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface ResourceSpecificConsumerDetails extends ConsumerDetails {
/**
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerKeysAllowed.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerKeysAllowed.java
index 8d77626bf..5f70c138e 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerKeysAllowed.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerKeysAllowed.java
@@ -24,10 +24,14 @@
/**
* The consumer keys that are allowed to access the specified method.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@Target ( { ElementType.TYPE, ElementType.METHOD } )
@Retention ( RetentionPolicy.RUNTIME )
+@Deprecated
public @interface ConsumerKeysAllowed {
String[] value();
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerRolesAllowed.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerRolesAllowed.java
index 31ffbb298..9e727afc3 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerRolesAllowed.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerRolesAllowed.java
@@ -24,10 +24,14 @@
/**
* The consumer roles that are allowed to access the specified method.
*
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@Target ( { ElementType.TYPE, ElementType.METHOD } )
@Retention ( RetentionPolicy.RUNTIME )
+@Deprecated
public @interface ConsumerRolesAllowed {
String[] value();
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityConfig.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityConfig.java
index e6ad3e9b1..8d56db062 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityConfig.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityConfig.java
@@ -20,10 +20,14 @@
/**
* Security config for consumer authorization of a method.
- *
+ *
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class ConsumerSecurityConfig extends SecurityConfig {
public static final ConsumerSecurityConfig DENY_ALL_ATTRIBUTE = new ConsumerSecurityConfig(DenyAllConsumers.class.getName(), null);
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityMetadataSource.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityMetadataSource.java
index 8fcd6fe40..16d3d5e13 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityMetadataSource.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityMetadataSource.java
@@ -27,9 +27,13 @@
import java.lang.annotation.Annotation;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
+@Deprecated
public class ConsumerSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource {
protected List findAttributes(Class clazz) {
diff --git a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityVoter.java b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityVoter.java
index fc26ba7c1..94ee09b8e 100644
--- a/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityVoter.java
+++ b/spring-security-oauth/src/main/java/org/springframework/security/oauth/provider/attributes/ConsumerSecurityVoter.java
@@ -26,9 +26,13 @@
import java.util.Collection;
/**
+ *
+ * @deprecated The OAuth 1.0 Protocol RFC 5849 is obsoleted by the OAuth 2.0 Authorization Framework RFC 6749.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
+@Deprecated
public class ConsumerSecurityVoter implements AccessDecisionVoter
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class DefaultOAuth2ClientContext implements OAuth2ClientContext, Serializable {
private static final long serialVersionUID = 914967629530462926L;
@@ -21,7 +25,7 @@ public class DefaultOAuth2ClientContext implements OAuth2ClientContext, Serializ
private AccessTokenRequest accessTokenRequest;
- private Map state = new HashMap();
+ private Map state = new ConcurrentHashMap();
public DefaultOAuth2ClientContext() {
this(new DefaultAccessTokenRequest());
@@ -50,6 +54,7 @@ public AccessTokenRequest getAccessTokenRequest() {
}
public void setPreservedState(String stateKey, Object preservedState) {
+ state.clear();
state.put(stateKey, preservedState);
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/DefaultOAuth2RequestAuthenticator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/DefaultOAuth2RequestAuthenticator.java
index a6114b9fe..c6b8d5a26 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/DefaultOAuth2RequestAuthenticator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/DefaultOAuth2RequestAuthenticator.java
@@ -20,9 +20,13 @@
import org.springframework.util.StringUtils;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class DefaultOAuth2RequestAuthenticator implements OAuth2RequestAuthenticator {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2ClientContext.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2ClientContext.java
index 9af13b874..dc02aaf3a 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2ClientContext.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2ClientContext.java
@@ -16,9 +16,13 @@
import org.springframework.security.oauth2.common.OAuth2AccessToken;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface OAuth2ClientContext {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RequestAuthenticator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RequestAuthenticator.java
index 6b668bd6b..4cbed416d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RequestAuthenticator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RequestAuthenticator.java
@@ -17,9 +17,13 @@
import org.springframework.security.oauth2.client.resource.OAuth2ProtectedResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface OAuth2RequestAuthenticator {
void authenticate(OAuth2ProtectedResourceDetails resource, OAuth2ClientContext clientContext, ClientHttpRequest request);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestOperations.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestOperations.java
index 8a3967f7e..839f5fd77 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestOperations.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestOperations.java
@@ -22,9 +22,13 @@
import org.springframework.web.client.RestOperations;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface OAuth2RestOperations extends RestOperations {
OAuth2AccessToken getAccessToken() throws UserRedirectRequiredException;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestTemplate.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestTemplate.java
index e44efd15b..3f8c18452 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestTemplate.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/OAuth2RestTemplate.java
@@ -2,10 +2,12 @@
import java.io.IOException;
import java.io.UnsupportedEncodingException;
+import java.lang.reflect.Field;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URLEncoder;
import java.util.Arrays;
+import java.util.Calendar;
import org.springframework.http.HttpMethod;
import org.springframework.http.client.ClientHttpRequest;
@@ -24,6 +26,8 @@
import org.springframework.security.oauth2.common.AuthenticationScheme;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.common.exceptions.InvalidTokenException;
+import org.springframework.util.Assert;
+import org.springframework.util.ReflectionUtils;
import org.springframework.web.client.RequestCallback;
import org.springframework.web.client.ResponseErrorHandler;
import org.springframework.web.client.ResponseExtractor;
@@ -32,10 +36,14 @@
/**
* Rest template that is able to make OAuth2-authenticated REST requests with the credentials of the provided resource.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class OAuth2RestTemplate extends RestTemplate implements OAuth2RestOperations {
private final OAuth2ProtectedResourceDetails resource;
@@ -50,6 +58,8 @@ public class OAuth2RestTemplate extends RestTemplate implements OAuth2RestOperat
private OAuth2RequestAuthenticator authenticator = new DefaultOAuth2RequestAuthenticator();
+ private int clockSkew = 30;
+
public OAuth2RestTemplate(OAuth2ProtectedResourceDetails resource) {
this(resource, new DefaultOAuth2ClientContext());
}
@@ -168,7 +178,7 @@ public OAuth2AccessToken getAccessToken() throws UserRedirectRequiredException {
OAuth2AccessToken accessToken = context.getAccessToken();
- if (accessToken == null || accessToken.isExpired()) {
+ if (accessToken == null || hasTokenExpired(accessToken)) {
try {
accessToken = acquireAccessToken(context);
}
@@ -189,6 +199,16 @@ public OAuth2AccessToken getAccessToken() throws UserRedirectRequiredException {
return accessToken;
}
+ private boolean hasTokenExpired(OAuth2AccessToken accessToken) {
+ Calendar now = Calendar.getInstance();
+ Calendar expiresAt = (Calendar) now.clone();
+ if (accessToken.getExpiration() != null) {
+ expiresAt.setTime(accessToken.getExpiration());
+ expiresAt.add(Calendar.SECOND, -this.clockSkew);
+ }
+ return now.after(expiresAt);
+ }
+
/**
* @return the context for this template
*/
@@ -269,6 +289,42 @@ protected URI appendQueryParameter(URI uri, OAuth2AccessToken accessToken) {
public void setAccessTokenProvider(AccessTokenProvider accessTokenProvider) {
this.accessTokenProvider = accessTokenProvider;
+ propagateClockSkewToAccessTokenProvider(this.clockSkew, accessTokenProvider);
+ }
+
+ /**
+ * Sets the maximum acceptable clock skew, which is used when checking the
+ * {@link OAuth2AccessToken access token} expiry. The default is 30 seconds.
+ *
+ * @param clockSkew the maximum acceptable clock skew
+ */
+ public void setClockSkew(int clockSkew) {
+ Assert.isTrue(clockSkew >= 0, "clockSkew must be >= 0");
+ this.clockSkew = clockSkew;
+ propagateClockSkewToAccessTokenProvider(clockSkew, this.accessTokenProvider);
}
-}
+ /**
+ * Propagates the maximum acceptable clock skew, which is used when checking the
+ * {@link OAuth2AccessToken access token} expiry into the given {@link AccessTokenProvider} if it is an instance of
+ * {@link AccessTokenProviderChain}.
+ *
+ * Note: The clock skew value is injected via reflection as version 2.5.0 was the final minor release before EOL of
+ * this project and the public API must not be changed in patch releases.
+ *
+ * @param clockSkew the maximum acceptable clock skew
+ * @param accessTokenProvider the access token provider
+ */
+ private static void propagateClockSkewToAccessTokenProvider(int clockSkew, AccessTokenProvider accessTokenProvider) {
+ if (!(accessTokenProvider instanceof AccessTokenProviderChain)) {
+ return;
+ }
+
+ Field field = ReflectionUtils.findField(accessTokenProvider.getClass(), "clockSkew");
+ if (field == null) {
+ return;
+ }
+ field.setAccessible(true);
+ ReflectionUtils.setField(field, accessTokenProvider, clockSkew);
+ }
+}
\ No newline at end of file
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderConfiguration.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderConfiguration.java
index 2ec7938e2..43caf5989 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderConfiguration.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderConfiguration.java
@@ -21,11 +21,15 @@
/**
* Configuration information for an OAuth 2.0 Provider.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Joe Grandja
* @since 2.2
* @see ProviderDiscoveryClient
* @see OpenID Connect Discovery 1.0
*/
+@Deprecated
public class ProviderConfiguration {
private URL issuer;
private URL authorizationEndpoint;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderDiscoveryClient.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderDiscoveryClient.java
index 7f456a6d5..d33fa7c97 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderDiscoveryClient.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/discovery/ProviderDiscoveryClient.java
@@ -31,11 +31,15 @@
* NOTE: This is a partial implementation that only discovers a small subset
* of the available provider configuration information.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Joe Grandja
* @since 2.2
* @see ProviderConfiguration
* @see OpenID Connect Discovery 1.0
*/
+@Deprecated
public class ProviderDiscoveryClient {
private static final String PROVIDER_END_PATH = "/.well-known/openid-configuration";
private static final String ISSUER_ATTR_NAME = "issuer";
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2AuthenticationFailureEvent.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2AuthenticationFailureEvent.java
index 9d3c4f0ed..a32ccd1cc 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2AuthenticationFailureEvent.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2AuthenticationFailureEvent.java
@@ -4,7 +4,13 @@
import org.springframework.security.authentication.event.AbstractAuthenticationFailureEvent;
import org.springframework.security.core.AuthenticationException;
+/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
@SuppressWarnings("serial")
+@Deprecated
public class OAuth2AuthenticationFailureEvent extends AbstractAuthenticationFailureEvent {
public OAuth2AuthenticationFailureEvent(AuthenticationException exception) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientAuthenticationProcessingFilter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientAuthenticationProcessingFilter.java
index aeb8f477e..39e693bb0 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientAuthenticationProcessingFilter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientAuthenticationProcessingFilter.java
@@ -46,10 +46,14 @@
/**
* An OAuth2 client filter that can be used to acquire an OAuth2 access token from an authorization server, and load an
* authentication object into the SecurityContext
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Vidya Valmikinathan
*
*/
+@Deprecated
public class OAuth2ClientAuthenticationProcessingFilter extends AbstractAuthenticationProcessingFilter {
public OAuth2RestOperations restTemplate;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientContextFilter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientContextFilter.java
index 2aa69c30c..42ce00370 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientContextFilter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/OAuth2ClientContextFilter.java
@@ -27,10 +27,14 @@
/**
* Security filter for an OAuth2 client.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class OAuth2ClientContextFilter implements Filter, InitializingBean {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/DefaultStateKeyGenerator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/DefaultStateKeyGenerator.java
index 94af21a2c..7bf3bb131 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/DefaultStateKeyGenerator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/DefaultStateKeyGenerator.java
@@ -16,9 +16,13 @@
import org.springframework.security.oauth2.common.util.RandomValueStringGenerator;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class DefaultStateKeyGenerator implements StateKeyGenerator {
private RandomValueStringGenerator generator = new RandomValueStringGenerator();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/StateKeyGenerator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/StateKeyGenerator.java
index 81cbd9511..bb904f7e0 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/StateKeyGenerator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/filter/state/StateKeyGenerator.java
@@ -17,10 +17,14 @@
/**
* Stategy for generating random keys for state. The state key is important protection for client apps against
* cross-site request forgery.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface StateKeyGenerator {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/AccessTokenRequiredException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/AccessTokenRequiredException.java
index fc4d42f72..e8509a6f9 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/AccessTokenRequiredException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/AccessTokenRequiredException.java
@@ -4,9 +4,13 @@
import org.springframework.security.oauth2.client.resource.OAuth2ProtectedResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class AccessTokenRequiredException extends InsufficientAuthenticationException {
private final OAuth2ProtectedResourceDetails resource;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/OAuth2ErrorHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/OAuth2ErrorHandler.java
index 8b2b42038..cfb495cfd 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/OAuth2ErrorHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/OAuth2ErrorHandler.java
@@ -37,8 +37,13 @@
/**
* Error handler specifically for an oauth 2 response.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuth2ErrorHandler implements ResponseErrorHandler {
private final ResponseErrorHandler errorHandler;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/StringSplitUtils.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/StringSplitUtils.java
index 6eab12a45..e2c592e73 100755
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/StringSplitUtils.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/http/StringSplitUtils.java
@@ -10,7 +10,12 @@
/**
* Provides several String manipulation methods. Copied from deleted org.springframework.security.util.StringSplitUtils
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
*/
+@Deprecated
public class StringSplitUtils {
private static final String[] EMPTY_STRING_ARRAY = new String[0];
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/BaseOAuth2ProtectedResourceDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/BaseOAuth2ProtectedResourceDetails.java
index 3608eb1f4..788b0b45e 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/BaseOAuth2ProtectedResourceDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/BaseOAuth2ProtectedResourceDetails.java
@@ -7,9 +7,13 @@
import org.springframework.util.StringUtils;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class BaseOAuth2ProtectedResourceDetails implements OAuth2ProtectedResourceDetails {
private String id;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2AccessDeniedException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2AccessDeniedException.java
index 072748cb6..0037c7d40 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2AccessDeniedException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2AccessDeniedException.java
@@ -5,11 +5,15 @@
/**
* When access is denied we usually want a 403, but we want the same treatment as all the other OAuth2Exception types,
* so this is not a Spring Security AccessDeniedException.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class OAuth2AccessDeniedException extends OAuth2Exception {
private OAuth2ProtectedResourceDetails resource;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2ProtectedResourceDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2ProtectedResourceDetails.java
index a539f758d..145ae383d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2ProtectedResourceDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/OAuth2ProtectedResourceDetails.java
@@ -6,10 +6,14 @@
/**
* Details for an OAuth2-protected resource.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public interface OAuth2ProtectedResourceDetails {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserApprovalRequiredException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserApprovalRequiredException.java
index f885264d8..d7505f946 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserApprovalRequiredException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserApprovalRequiredException.java
@@ -20,11 +20,15 @@
/**
* Exception indicating that user approval is required, with some indication of how to signal the approval.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@SuppressWarnings("serial")
+@Deprecated
public class UserApprovalRequiredException extends RuntimeException {
private final String approvalUri;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserRedirectRequiredException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserRedirectRequiredException.java
index 3146d9199..6b8a60b9b 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserRedirectRequiredException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/resource/UserRedirectRequiredException.java
@@ -4,10 +4,14 @@
/**
* Special exception thrown when a user redirect is required in order to obtain an OAuth2 access token.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UserRedirectRequiredException extends RuntimeException {
private final String redirectUri;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/BeforeOAuth2Context.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/BeforeOAuth2Context.java
index 1fa2fbdd3..a289eb6ee 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/BeforeOAuth2Context.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/BeforeOAuth2Context.java
@@ -21,11 +21,15 @@
* Marker annotation for methods to be run before the OAuth2Context is setup by the {@link OAuth2ContextSetup} rule, and
* consequently before the regular JUnit @Before methods, which are executed only after the
* OAuth2Context is setup.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
+@Deprecated
public @interface BeforeOAuth2Context {
}
\ No newline at end of file
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextConfiguration.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextConfiguration.java
index e4bf56ed4..06a68b5db 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextConfiguration.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextConfiguration.java
@@ -30,12 +30,16 @@
* Annotation to signal that an OAuth2 authentication should be created and and provided to the enclosing scope (method
* or class). Used at the class level it will apply to all test methods (and {@link BeforeOAuth2Context} initializers).
* Used at the method level it will apply only to the method, overriding any value found on the enclosing class.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@Retention(RetentionPolicy.RUNTIME)
@Target({ ElementType.TYPE, ElementType.METHOD })
+@Deprecated
public @interface OAuth2ContextConfiguration {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextSetup.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextSetup.java
index 1f0db2cbc..9633ef9cf 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextSetup.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/OAuth2ContextSetup.java
@@ -92,11 +92,15 @@
*
* @see OAuth2ContextConfiguration
* @see BeforeOAuth2Context
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@SuppressWarnings("deprecation")
+@Deprecated
public class OAuth2ContextSetup extends TestWatchman {
private static Log logger = LogFactory.getLog(OAuth2ContextSetup.class);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/RestTemplateHolder.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/RestTemplateHolder.java
index c14aabf5f..db8f9b513 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/RestTemplateHolder.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/RestTemplateHolder.java
@@ -16,10 +16,14 @@
/**
* Marker interface for an object that has a getter and setter for a {@link RestOperations}.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface RestTemplateHolder {
void setRestTemplate(RestOperations restTemplate);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/TestAccounts.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/TestAccounts.java
index 782532ce7..8d9706e53 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/TestAccounts.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/test/TestAccounts.java
@@ -17,9 +17,13 @@
import org.springframework.security.oauth2.client.token.grant.password.ResourceOwnerPasswordResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface TestAccounts {
String getUserName();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProvider.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProvider.java
index bd3e3a382..a803c3df6 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProvider.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProvider.java
@@ -24,10 +24,14 @@
/**
* A strategy which knows how to obtain an access token for a specific resource.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public interface AccessTokenProvider {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProviderChain.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProviderChain.java
index 86e5abc0e..51cc6c9f3 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProviderChain.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenProviderChain.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2011 the original author or authors.
+ * Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -15,6 +15,7 @@
*/
package org.springframework.security.oauth2.client.token;
+import java.util.Calendar;
import java.util.Collections;
import java.util.List;
@@ -36,9 +37,13 @@
* chain to find the first provider that supports the resource and use it to obtain the
* access token. Note that the order of the chain is relevant.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class AccessTokenProviderChain extends OAuth2AccessTokenSupport
implements AccessTokenProvider {
@@ -46,6 +51,8 @@ public class AccessTokenProviderChain extends OAuth2AccessTokenSupport
private ClientTokenServices clientTokenServices;
+ private int clockSkew = 30;
+
public AccessTokenProviderChain(List chain) {
this.chain = chain == null ? Collections. emptyList()
: Collections.unmodifiableList(chain);
@@ -100,7 +107,7 @@ public OAuth2AccessToken obtainAccessToken(OAuth2ProtectedResourceDetails resour
}
if (existingToken != null) {
- if (existingToken.isExpired()) {
+ if (hasTokenExpired(existingToken)) {
if (clientTokenServices != null) {
clientTokenServices.removeAccessToken(resource, auth);
}
@@ -184,4 +191,20 @@ public OAuth2AccessToken refreshAccessToken(OAuth2ProtectedResourceDetails resou
resource);
}
+ /**
+ * Checks if the given {@link OAuth2AccessToken access token} should be considered to have expired based on the
+ * token's expiration time and the clock skew.
+ *
+ * @param token the token to be checked
+ * @return true if the token should be considered expired, false otherwise
+ */
+ private boolean hasTokenExpired(OAuth2AccessToken token) {
+ Calendar now = Calendar.getInstance();
+ Calendar expiresAt = (Calendar) now.clone();
+ if (token.getExpiration() != null) {
+ expiresAt.setTime(token.getExpiration());
+ expiresAt.add(Calendar.SECOND, -this.clockSkew);
+ }
+ return now.after(expiresAt);
+ }
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenRequest.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenRequest.java
index 85d0c2a67..02c23baf8 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenRequest.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/AccessTokenRequest.java
@@ -21,6 +21,12 @@
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.util.MultiValueMap;
+/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
+@Deprecated
public interface AccessTokenRequest extends MultiValueMap {
OAuth2AccessToken getExistingToken();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientKeyGenerator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientKeyGenerator.java
index 58f376277..cdc58adf2 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientKeyGenerator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientKeyGenerator.java
@@ -18,9 +18,13 @@
import org.springframework.security.oauth2.client.resource.OAuth2ProtectedResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface ClientKeyGenerator {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientTokenServices.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientTokenServices.java
index 0aef5cc19..2f3937b58 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientTokenServices.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/ClientTokenServices.java
@@ -19,9 +19,13 @@
import org.springframework.security.oauth2.common.OAuth2AccessToken;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface ClientTokenServices {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultAccessTokenRequest.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultAccessTokenRequest.java
index 72a8f21af..3136fd6b4 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultAccessTokenRequest.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultAccessTokenRequest.java
@@ -25,10 +25,14 @@
/**
* Local context for an access token request encapsulating the parameters that are sent by the client requesting the
* token, as opposed to the more static variables representing the client itself and the resource being targeted.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class DefaultAccessTokenRequest implements AccessTokenRequest, Serializable {
private static final long serialVersionUID = 914967629530462926L;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultClientKeyGenerator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultClientKeyGenerator.java
index b473d77c2..a083ceacf 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultClientKeyGenerator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultClientKeyGenerator.java
@@ -25,10 +25,14 @@
/**
* Basic key generator taking into account the client id, scope and username (principal name) if they exist.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class DefaultClientKeyGenerator implements ClientKeyGenerator {
private static final String CLIENT_ID = "client_id";
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultRequestEnhancer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultRequestEnhancer.java
index 09ca76bd7..322d58ec7 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultRequestEnhancer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/DefaultRequestEnhancer.java
@@ -21,6 +21,12 @@
import org.springframework.security.oauth2.client.resource.OAuth2ProtectedResourceDetails;
import org.springframework.util.MultiValueMap;
+/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
+@Deprecated
public class DefaultRequestEnhancer implements RequestEnhancer {
private Set parameterIncludes = Collections.emptySet();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/JdbcClientTokenServices.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/JdbcClientTokenServices.java
index fbc8c9d45..4f4474541 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/JdbcClientTokenServices.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/JdbcClientTokenServices.java
@@ -20,9 +20,13 @@
/**
* Implementation of token services that stores tokens in a database for retrieval by client applications.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class JdbcClientTokenServices implements ClientTokenServices {
private static final Log LOG = LogFactory.getLog(JdbcClientTokenServices.class);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/OAuth2AccessTokenSupport.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/OAuth2AccessTokenSupport.java
index 0cf556a34..c31822633 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/OAuth2AccessTokenSupport.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/OAuth2AccessTokenSupport.java
@@ -39,17 +39,21 @@
/**
* Base support logic for obtaining access tokens.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public abstract class OAuth2AccessTokenSupport {
protected final Log logger = LogFactory.getLog(getClass());
private static final FormHttpMessageConverter FORM_MESSAGE_CONVERTER = new FormHttpMessageConverter();
- private RestOperations restTemplate;
+ private volatile RestOperations restTemplate;
private List> messageConverters;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/RequestEnhancer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/RequestEnhancer.java
index b6442bb1b..c49d1a841 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/RequestEnhancer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/RequestEnhancer.java
@@ -16,6 +16,12 @@
import org.springframework.security.oauth2.client.resource.OAuth2ProtectedResourceDetails;
import org.springframework.util.MultiValueMap;
+/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
+@Deprecated
public interface RequestEnhancer {
void enhance(AccessTokenRequest request, OAuth2ProtectedResourceDetails resource, MultiValueMap form,
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/ClientAuthenticationHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/ClientAuthenticationHandler.java
index b62669fda..91b625653 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/ClientAuthenticationHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/ClientAuthenticationHandler.java
@@ -18,10 +18,14 @@
/**
* Logic for handling client authentication.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public interface ClientAuthenticationHandler {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/DefaultClientAuthenticationHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/DefaultClientAuthenticationHandler.java
index 88a0a6fa0..331c26f4c 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/DefaultClientAuthenticationHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/auth/DefaultClientAuthenticationHandler.java
@@ -11,10 +11,14 @@
/**
* Default implementation of the client authentication handler.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class DefaultClientAuthenticationHandler implements ClientAuthenticationHandler {
public void authenticateTokenRequest(OAuth2ProtectedResourceDetails resource, MultiValueMap form,
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsAccessTokenProvider.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsAccessTokenProvider.java
index b7adaecb5..4d7c664c7 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsAccessTokenProvider.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsAccessTokenProvider.java
@@ -13,14 +13,19 @@
import org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport;
import org.springframework.security.oauth2.common.OAuth2RefreshToken;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
+import org.springframework.security.oauth2.common.util.OAuth2Utils;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
/**
* Provider for obtaining an oauth2 access token by using client credentials.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class ClientCredentialsAccessTokenProvider extends OAuth2AccessTokenSupport implements AccessTokenProvider {
public boolean supportsResource(OAuth2ProtectedResourceDetails resource) {
@@ -48,7 +53,7 @@ public OAuth2AccessToken obtainAccessToken(OAuth2ProtectedResourceDetails detail
private MultiValueMap getParametersForTokenRequest(ClientCredentialsResourceDetails resource) {
MultiValueMap form = new LinkedMultiValueMap();
- form.set("grant_type", "client_credentials");
+ form.set(OAuth2Utils.GRANT_TYPE, "client_credentials");
if (resource.isScoped()) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsResourceDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsResourceDetails.java
index 9ddc01b8d..fe2e1a001 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsResourceDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/client/ClientCredentialsResourceDetails.java
@@ -3,8 +3,12 @@
import org.springframework.security.oauth2.client.resource.BaseOAuth2ProtectedResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class ClientCredentialsResourceDetails extends BaseOAuth2ProtectedResourceDetails {
public ClientCredentialsResourceDetails() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeAccessTokenProvider.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeAccessTokenProvider.java
index 8a6ea6390..4e48c9685 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeAccessTokenProvider.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeAccessTokenProvider.java
@@ -65,10 +65,14 @@
/**
* Provider for obtaining an oauth2 access token by using an authorization code.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class AuthorizationCodeAccessTokenProvider extends OAuth2AccessTokenSupport implements AccessTokenProvider {
private StateKeyGenerator stateKeyGenerator = new DefaultStateKeyGenerator();
@@ -215,7 +219,7 @@ public OAuth2AccessToken refreshAccessToken(OAuth2ProtectedResourceDetails resou
OAuth2RefreshToken refreshToken, AccessTokenRequest request) throws UserRedirectRequiredException,
OAuth2AccessDeniedException {
MultiValueMap form = new LinkedMultiValueMap();
- form.add("grant_type", "refresh_token");
+ form.add(OAuth2Utils.GRANT_TYPE, "refresh_token");
form.add("refresh_token", refreshToken.getValue());
try {
return retrieveToken(request, resource, form, getHeadersForTokenRequest(request));
@@ -244,7 +248,7 @@ private MultiValueMap getParametersForTokenRequest(Authorization
AccessTokenRequest request) {
MultiValueMap form = new LinkedMultiValueMap();
- form.set("grant_type", "authorization_code");
+ form.set(OAuth2Utils.GRANT_TYPE, "authorization_code");
form.set("code", request.getAuthorizationCode());
Object preservedState = request.getPreservedState();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeResourceDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeResourceDetails.java
index 1e445c178..790b6b966 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeResourceDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/code/AuthorizationCodeResourceDetails.java
@@ -3,9 +3,13 @@
import org.springframework.security.oauth2.client.token.grant.redirect.AbstractRedirectResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class AuthorizationCodeResourceDetails extends AbstractRedirectResourceDetails {
public AuthorizationCodeResourceDetails() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitAccessTokenProvider.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitAccessTokenProvider.java
index 664de42d4..35b451ebe 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitAccessTokenProvider.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitAccessTokenProvider.java
@@ -34,9 +34,13 @@
* parameters, together with any other information available (e.g. from a cookie), and decide if a user can be
* authenticated and if the user has approved the grant of the access token. Only if those two conditions are met should
* an access token be available through this provider.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class ImplicitAccessTokenProvider extends OAuth2AccessTokenSupport implements AccessTokenProvider {
public boolean supportsResource(OAuth2ProtectedResourceDetails resource) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitResourceDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitResourceDetails.java
index 6acb5ba47..9593b63a7 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitResourceDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/implicit/ImplicitResourceDetails.java
@@ -3,8 +3,12 @@
import org.springframework.security.oauth2.client.token.grant.redirect.AbstractRedirectResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class ImplicitResourceDetails extends AbstractRedirectResourceDetails {
public ImplicitResourceDetails() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordAccessTokenProvider.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordAccessTokenProvider.java
index 3fa397bcb..fb53594a7 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordAccessTokenProvider.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordAccessTokenProvider.java
@@ -13,14 +13,19 @@
import org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport;
import org.springframework.security.oauth2.common.OAuth2RefreshToken;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
+import org.springframework.security.oauth2.common.util.OAuth2Utils;
import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
/**
* Provider for obtaining an oauth2 access token by using resource owner password.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class ResourceOwnerPasswordAccessTokenProvider extends OAuth2AccessTokenSupport implements AccessTokenProvider {
public boolean supportsResource(OAuth2ProtectedResourceDetails resource) {
@@ -35,7 +40,7 @@ public OAuth2AccessToken refreshAccessToken(OAuth2ProtectedResourceDetails resou
OAuth2RefreshToken refreshToken, AccessTokenRequest request) throws UserRedirectRequiredException,
OAuth2AccessDeniedException {
MultiValueMap form = new LinkedMultiValueMap();
- form.add("grant_type", "refresh_token");
+ form.add(OAuth2Utils.GRANT_TYPE, "refresh_token");
form.add("refresh_token", refreshToken.getValue());
return retrieveToken(request, resource, form, new HttpHeaders());
}
@@ -51,7 +56,7 @@ public OAuth2AccessToken obtainAccessToken(OAuth2ProtectedResourceDetails detail
private MultiValueMap getParametersForTokenRequest(ResourceOwnerPasswordResourceDetails resource, AccessTokenRequest request) {
MultiValueMap form = new LinkedMultiValueMap();
- form.set("grant_type", "password");
+ form.set(OAuth2Utils.GRANT_TYPE, "password");
form.set("username", resource.getUsername());
form.set("password", resource.getPassword());
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordResourceDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordResourceDetails.java
index 54fde4247..21ac5338f 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordResourceDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/password/ResourceOwnerPasswordResourceDetails.java
@@ -18,8 +18,12 @@
import org.springframework.security.oauth2.client.resource.BaseOAuth2ProtectedResourceDetails;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public class ResourceOwnerPasswordResourceDetails extends BaseOAuth2ProtectedResourceDetails {
private String username;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/redirect/AbstractRedirectResourceDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/redirect/AbstractRedirectResourceDetails.java
index 8b43a2cd4..15805dbf5 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/redirect/AbstractRedirectResourceDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/client/token/grant/redirect/AbstractRedirectResourceDetails.java
@@ -5,8 +5,12 @@
import org.springframework.security.oauth2.client.token.DefaultAccessTokenRequest;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
+@Deprecated
public abstract class AbstractRedirectResourceDetails extends BaseOAuth2ProtectedResourceDetails {
private String preEstablishedRedirectUri;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/AuthenticationScheme.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/AuthenticationScheme.java
index 86b6e30e6..0ed5d6b67 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/AuthenticationScheme.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/AuthenticationScheme.java
@@ -14,7 +14,11 @@
/**
* Enumeration of possible methods for transmitting authentication credentials.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
*/
+@Deprecated
public enum AuthenticationScheme {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultExpiringOAuth2RefreshToken.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultExpiringOAuth2RefreshToken.java
index 841480d52..4806e2a4c 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultExpiringOAuth2RefreshToken.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultExpiringOAuth2RefreshToken.java
@@ -3,8 +3,12 @@
import java.util.Date;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class DefaultExpiringOAuth2RefreshToken extends DefaultOAuth2RefreshToken implements ExpiringOAuth2RefreshToken {
private static final long serialVersionUID = 3449554332764129719L;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2AccessToken.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2AccessToken.java
index 4ecf4a186..eeb5b6527 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2AccessToken.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2AccessToken.java
@@ -11,11 +11,15 @@
/**
* Basic access token for OAuth 2.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
* @author Rob Winch
*/
+@Deprecated
public class DefaultOAuth2AccessToken implements Serializable, OAuth2AccessToken {
private static final long serialVersionUID = 914967629530462926L;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2RefreshToken.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2RefreshToken.java
index c8df418d1..c78bb5410 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2RefreshToken.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultOAuth2RefreshToken.java
@@ -2,15 +2,19 @@
import java.io.Serializable;
-import org.codehaus.jackson.annotate.JsonCreator;
-import org.codehaus.jackson.annotate.JsonValue;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonValue;
/**
* An OAuth 2 refresh token.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class DefaultOAuth2RefreshToken implements Serializable, OAuth2RefreshToken {
private static final long serialVersionUID = 8349970621900575838L;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultThrowableAnalyzer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultThrowableAnalyzer.java
index 72ba20a09..2f341c2f2 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultThrowableAnalyzer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/DefaultThrowableAnalyzer.java
@@ -8,7 +8,11 @@
/**
* Default implementation of ThrowableAnalyzer which is capable of also unwrapping
* ServletExceptions.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
*/
+@Deprecated
public final class DefaultThrowableAnalyzer extends ThrowableAnalyzer {
/**
* @see org.springframework.security.web.util.ThrowableAnalyzer#initExtractorMap()
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/ExpiringOAuth2RefreshToken.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/ExpiringOAuth2RefreshToken.java
index d69672935..eb5fd46fe 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/ExpiringOAuth2RefreshToken.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/ExpiringOAuth2RefreshToken.java
@@ -15,9 +15,13 @@
import java.util.Date;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface ExpiringOAuth2RefreshToken extends OAuth2RefreshToken {
Date getExpiration();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessToken.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessToken.java
index 4176cf8b4..de4b0ada0 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessToken.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessToken.java
@@ -17,14 +17,15 @@
import java.util.Set;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
-@org.codehaus.jackson.map.annotate.JsonSerialize(using = OAuth2AccessTokenJackson1Serializer.class)
-@org.codehaus.jackson.map.annotate.JsonDeserialize(using = OAuth2AccessTokenJackson1Deserializer.class)
@com.fasterxml.jackson.databind.annotation.JsonSerialize(using = OAuth2AccessTokenJackson2Serializer.class)
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = OAuth2AccessTokenJackson2Deserializer.class)
-
+@Deprecated
public interface OAuth2AccessToken {
public static String BEARER_TYPE = "Bearer";
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson1Deserializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson1Deserializer.java
deleted file mode 100644
index f5288bde7..000000000
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson1Deserializer.java
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright 2006-2010 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
- */
-package org.springframework.security.oauth2.common;
-
-import java.io.IOException;
-import java.util.Date;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.Set;
-
-import org.codehaus.jackson.JsonParseException;
-import org.codehaus.jackson.JsonParser;
-import org.codehaus.jackson.JsonProcessingException;
-import org.codehaus.jackson.JsonToken;
-import org.codehaus.jackson.map.DeserializationContext;
-import org.codehaus.jackson.map.JsonDeserializer;
-import org.codehaus.jackson.map.deser.StdDeserializer;
-import org.springframework.security.oauth2.common.util.OAuth2Utils;
-
-/**
- *
- * Provides the ability to deserialize JSON response into an {@link OAuth2AccessToken} with jackson by implementing
- * {@link JsonDeserializer}.
- *
- *
- * The expected format of the access token is defined by Successful Response.
- *
- *
- * @author Rob Winch
- * @see OAuth2AccessTokenJackson1Serializer
- */
-@SuppressWarnings("deprecation")
-public final class OAuth2AccessTokenJackson1Deserializer extends StdDeserializer {
-
- public OAuth2AccessTokenJackson1Deserializer() {
- super(OAuth2AccessToken.class);
- }
-
- @Override
- public OAuth2AccessToken deserialize(JsonParser jp, DeserializationContext ctxt) throws IOException,
- JsonProcessingException {
-
- String tokenValue = null;
- String tokenType = null;
- String refreshToken = null;
- Long expiresIn = null;
- Set scope = null;
- Map additionalInformation = new LinkedHashMap();
-
- // TODO What should occur if a parameter exists twice
- while (jp.nextToken() != JsonToken.END_OBJECT) {
- String name = jp.getCurrentName();
- jp.nextToken();
- if (OAuth2AccessToken.ACCESS_TOKEN.equals(name)) {
- tokenValue = jp.getText();
- }
- else if (OAuth2AccessToken.TOKEN_TYPE.equals(name)) {
- tokenType = jp.getText();
- }
- else if (OAuth2AccessToken.REFRESH_TOKEN.equals(name)) {
- refreshToken = jp.getText();
- }
- else if (OAuth2AccessToken.EXPIRES_IN.equals(name)) {
- try {
- expiresIn = jp.getLongValue();
- } catch (JsonParseException e) {
- expiresIn = Long.valueOf(jp.getText());
- }
- }
- else if (OAuth2AccessToken.SCOPE.equals(name)) {
- String text = jp.getText();
- scope = OAuth2Utils.parseParameterList(text);
- } else {
- additionalInformation.put(name, jp.readValueAs(Object.class));
- }
- }
-
- // TODO What should occur if a required parameter (tokenValue or tokenType) is missing?
-
- DefaultOAuth2AccessToken accessToken = new DefaultOAuth2AccessToken(tokenValue);
- accessToken.setTokenType(tokenType);
- if (expiresIn != null) {
- accessToken.setExpiration(new Date(System.currentTimeMillis() + (expiresIn * 1000)));
- }
- if (refreshToken != null) {
- accessToken.setRefreshToken(new DefaultOAuth2RefreshToken(refreshToken));
- }
- accessToken.setScope(scope);
- accessToken.setAdditionalInformation(additionalInformation);
-
- return accessToken;
- }
-}
\ No newline at end of file
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson1Serializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson1Serializer.java
deleted file mode 100644
index 1fd3fe777..000000000
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson1Serializer.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright 2006-2010 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
- */
-package org.springframework.security.oauth2.common;
-
-import java.io.IOException;
-import java.util.Date;
-import java.util.Map;
-import java.util.Set;
-
-import org.codehaus.jackson.JsonGenerationException;
-import org.codehaus.jackson.JsonGenerator;
-import org.codehaus.jackson.map.JsonSerializer;
-import org.codehaus.jackson.map.SerializerProvider;
-import org.codehaus.jackson.map.ser.SerializerBase;
-import org.springframework.util.Assert;
-
-/**
- * Provides the ability to serialize an {@link OAuth2AccessToken} with jackson by implementing {@link JsonSerializer}.
- * Refer to {@link OAuth2AccessTokenJackson1Deserializer} to learn more about the JSON format that is used.
- *
- * @author Rob Winch
- * @see OAuth2AccessTokenJackson1Deserializer
- */
-@SuppressWarnings("deprecation")
-public final class OAuth2AccessTokenJackson1Serializer extends SerializerBase {
-
- public OAuth2AccessTokenJackson1Serializer() {
- super(OAuth2AccessToken.class);
- }
-
- @Override
- public void serialize(OAuth2AccessToken token, JsonGenerator jgen, SerializerProvider provider) throws IOException,
- JsonGenerationException {
- jgen.writeStartObject();
- jgen.writeStringField(OAuth2AccessToken.ACCESS_TOKEN, token.getValue());
- jgen.writeStringField(OAuth2AccessToken.TOKEN_TYPE, token.getTokenType());
- OAuth2RefreshToken refreshToken = token.getRefreshToken();
- if (refreshToken != null) {
- jgen.writeStringField(OAuth2AccessToken.REFRESH_TOKEN, refreshToken.getValue());
- }
- Date expiration = token.getExpiration();
- if (expiration != null) {
- long now = System.currentTimeMillis();
- jgen.writeNumberField(OAuth2AccessToken.EXPIRES_IN, (expiration.getTime() - now) / 1000);
- }
- Set scope = token.getScope();
- if (scope != null && !scope.isEmpty()) {
- StringBuffer scopes = new StringBuffer();
- for (String s : scope) {
- Assert.hasLength(s, "Scopes cannot be null or empty. Got " + scope + "");
- scopes.append(s);
- scopes.append(" ");
- }
- jgen.writeStringField(OAuth2AccessToken.SCOPE, scopes.substring(0, scopes.length() - 1));
- }
- Map additionalInformation = token.getAdditionalInformation();
- for (String key : additionalInformation.keySet()) {
- jgen.writeObjectField(key, additionalInformation.get(key));
- }
- jgen.writeEndObject();
- }
-}
\ No newline at end of file
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Deserializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Deserializer.java
index a9294e74b..ff0084019 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Deserializer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Deserializer.java
@@ -39,11 +39,15 @@
* href="https://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-5.1">Successful Response.
*
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Rob Winch
* @author Brian Clozel
* @see org.springframework.security.oauth2.common.OAuth2AccessTokenJackson2Serializer
*/
@SuppressWarnings("serial")
+@Deprecated
public final class OAuth2AccessTokenJackson2Deserializer extends StdDeserializer {
public OAuth2AccessTokenJackson2Deserializer() {
@@ -92,7 +96,7 @@ else if (OAuth2AccessToken.SCOPE.equals(name)) {
DefaultOAuth2AccessToken accessToken = new DefaultOAuth2AccessToken(tokenValue);
accessToken.setTokenType(tokenType);
- if (expiresIn != null) {
+ if (expiresIn != null && expiresIn != 0) {
accessToken.setExpiration(new Date(System.currentTimeMillis() + (expiresIn * 1000)));
}
if (refreshToken != null) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Serializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Serializer.java
index 60632949b..01fcb0921 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Serializer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2AccessTokenJackson2Serializer.java
@@ -26,12 +26,17 @@
/**
* Provides the ability to serialize an {@link org.springframework.security.oauth2.common.OAuth2AccessToken} with jackson2 by implementing {@link com.fasterxml.jackson.databind.JsonDeserializer}.
- * Refer to {@link org.springframework.security.oauth2.common.OAuth2AccessTokenJackson1Deserializer} to learn more about the JSON format that is used.
+ *
+ * The expected format of the access token is defined by Successful Response.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
*
* @author Rob Winch
* @author Brian Clozel
* @see org.springframework.security.oauth2.common.OAuth2AccessTokenJackson2Deserializer
*/
+@Deprecated
public final class OAuth2AccessTokenJackson2Serializer extends StdSerializer {
public OAuth2AccessTokenJackson2Serializer() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2RefreshToken.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2RefreshToken.java
index 2caf151e7..495fda30d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2RefreshToken.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/OAuth2RefreshToken.java
@@ -12,12 +12,16 @@
*/
package org.springframework.security.oauth2.common;
-import org.codehaus.jackson.annotate.JsonValue;
+import com.fasterxml.jackson.annotation.JsonValue;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface OAuth2RefreshToken {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/BadClientCredentialsException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/BadClientCredentialsException.java
index e928185f5..522af2175 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/BadClientCredentialsException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/BadClientCredentialsException.java
@@ -3,10 +3,14 @@
/**
* Exception thrown when a client was unable to authenticate.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class BadClientCredentialsException extends ClientAuthenticationException {
public BadClientCredentialsException() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/ClientAuthenticationException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/ClientAuthenticationException.java
index 5c0eb31d6..42d8dfe24 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/ClientAuthenticationException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/ClientAuthenticationException.java
@@ -2,11 +2,15 @@
/**
* Base exception
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public abstract class ClientAuthenticationException extends OAuth2Exception {
public ClientAuthenticationException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InsufficientScopeException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InsufficientScopeException.java
index c512f60aa..ff80461a2 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InsufficientScopeException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InsufficientScopeException.java
@@ -8,10 +8,14 @@
/**
* Exception representing insufficient scope in a token when a request is handled by a Resource Server. It is akin to an
* {@link AccessDeniedException} and should result in a 403 (FORBIDDEN) HTTP status.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class InsufficientScopeException extends OAuth2Exception {
public InsufficientScopeException(String msg, Set validScope) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidClientException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidClientException.java
index fd10e7b26..6aefe7d37 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidClientException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidClientException.java
@@ -3,10 +3,14 @@
/**
* Exception thrown when a client was unable to authenticate.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidClientException extends ClientAuthenticationException {
public InvalidClientException(String msg) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidGrantException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidGrantException.java
index b492d9452..2294cdffa 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidGrantException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidGrantException.java
@@ -1,10 +1,14 @@
package org.springframework.security.oauth2.common.exceptions;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidGrantException extends ClientAuthenticationException {
public InvalidGrantException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidRequestException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidRequestException.java
index 32b14681e..7b18897f4 100755
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidRequestException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidRequestException.java
@@ -1,9 +1,13 @@
package org.springframework.security.oauth2.common.exceptions;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidRequestException extends ClientAuthenticationException {
public InvalidRequestException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidScopeException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidScopeException.java
index f5989edd1..4a8f4b3b1 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidScopeException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidScopeException.java
@@ -8,11 +8,15 @@
* Exception representing an invalid scope in a token or authorization request (i.e. from an Authorization Server). Note
* that this is not the same as an access denied exception if the scope presented to a Resource Server is insufficient.
* The spec in this case mandates a 400 status code.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidScopeException extends OAuth2Exception {
public InvalidScopeException(String msg, Set validScope) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidTokenException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidTokenException.java
index 555cc4a7c..e8cb37507 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidTokenException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/InvalidTokenException.java
@@ -16,10 +16,14 @@
package org.springframework.security.oauth2.common.exceptions;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class InvalidTokenException extends ClientAuthenticationException {
public InvalidTokenException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2Exception.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2Exception.java
index 17819a1e3..4b4e9a802 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2Exception.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2Exception.java
@@ -6,16 +6,18 @@
/**
* Base exception for OAuth 2 exceptions.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Rob Winch
* @author Dave Syer
*/
@SuppressWarnings("serial")
-@org.codehaus.jackson.map.annotate.JsonSerialize(using = OAuth2ExceptionJackson1Serializer.class)
-@org.codehaus.jackson.map.annotate.JsonDeserialize(using = OAuth2ExceptionJackson1Deserializer.class)
@com.fasterxml.jackson.databind.annotation.JsonSerialize(using = OAuth2ExceptionJackson2Serializer.class)
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = OAuth2ExceptionJackson2Deserializer.class)
+@Deprecated
public class OAuth2Exception extends RuntimeException {
public static final String ERROR = "error";
@@ -36,36 +38,11 @@ public class OAuth2Exception extends RuntimeException {
private Map additionalInformation = null;
public OAuth2Exception(String msg, Throwable t) {
- super(assertErrorDescription(msg), t);
+ super(msg, t);
}
public OAuth2Exception(String msg) {
- super(assertErrorDescription(msg));
- }
-
- private static String assertErrorDescription(String description) {
- if (!isErrorDescriptionValid(description)) {
- throw new IllegalArgumentException("error_description contains invalid ASCII characters, it must conform to RFC 6749");
- }
- return description;
- }
-
- private static boolean isErrorDescriptionValid(String description) {
- if (description == null) {
- return true;
- }
- for (char c : description.toCharArray()) {
- if (withinTheRangeOf(c, 0x20, 0x21) ||
- withinTheRangeOf(c, 0x23, 0x5B) ||
- withinTheRangeOf(c, 0x5D, 0x7E)) {
- return true;
- }
- }
- return false;
- }
-
- private static boolean withinTheRangeOf(int c, int min, int max) {
- return c >= min && c <= max;
+ super(msg);
}
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson1Deserializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson1Deserializer.java
deleted file mode 100644
index a32e4e521..000000000
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson1Deserializer.java
+++ /dev/null
@@ -1,130 +0,0 @@
-/*
- * Copyright 2006-2011 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
- */
-package org.springframework.security.oauth2.common.exceptions;
-
-import java.io.IOException;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import org.codehaus.jackson.JsonParser;
-import org.codehaus.jackson.JsonProcessingException;
-import org.codehaus.jackson.JsonToken;
-import org.codehaus.jackson.map.DeserializationContext;
-import org.codehaus.jackson.map.JsonDeserializer;
-import org.springframework.security.oauth2.common.util.OAuth2Utils;
-
-/**
- * @author Dave Syer
- *
- */
-public class OAuth2ExceptionJackson1Deserializer extends JsonDeserializer {
-
- @Override
- public OAuth2Exception deserialize(JsonParser jp, DeserializationContext ctxt) throws IOException,
- JsonProcessingException {
-
- JsonToken t = jp.getCurrentToken();
- if (t == JsonToken.START_OBJECT) {
- t = jp.nextToken();
- }
- Map errorParams = new HashMap();
- for (; t == JsonToken.FIELD_NAME; t = jp.nextToken()) {
- // Must point to field name
- String fieldName = jp.getCurrentName();
- // And then the value...
- t = jp.nextToken();
- // Note: must handle null explicitly here; value deserializers won't
- Object value;
- if (t == JsonToken.VALUE_NULL) {
- value = null;
- }
- // Some servers might send back complex content
- else if (t == JsonToken.START_ARRAY) {
- value = jp.readValueAs(List.class);
- }
- else if (t == JsonToken.START_OBJECT) {
- value = jp.readValueAs(Map.class);
- }
- else {
- value = jp.getText();
- }
- errorParams.put(fieldName, value);
- }
-
- Object errorCode = errorParams.get("error");
- String errorMessage = errorParams.containsKey("error_description") ? errorParams.get("error_description")
- .toString() : null;
- if (errorMessage == null) {
- errorMessage = errorCode == null ? "OAuth Error" : errorCode.toString();
- }
-
- OAuth2Exception ex;
- if ("invalid_client".equals(errorCode)) {
- ex = new InvalidClientException(errorMessage);
- }
- else if ("unauthorized_client".equals(errorCode)) {
- ex = new UnauthorizedClientException(errorMessage);
- }
- else if ("invalid_grant".equals(errorCode)) {
- if (errorMessage.toLowerCase().contains("redirect") && errorMessage.toLowerCase().contains("match")) {
- ex = new RedirectMismatchException(errorMessage);
- }
- else {
- ex = new InvalidGrantException(errorMessage);
- }
- }
- else if ("invalid_scope".equals(errorCode)) {
- ex = new InvalidScopeException(errorMessage);
- }
- else if ("invalid_token".equals(errorCode)) {
- ex = new InvalidTokenException(errorMessage);
- }
- else if ("invalid_request".equals(errorCode)) {
- ex = new InvalidRequestException(errorMessage);
- }
- else if ("redirect_uri_mismatch".equals(errorCode)) {
- ex = new RedirectMismatchException(errorMessage);
- }
- else if ("unsupported_grant_type".equals(errorCode)) {
- ex = new UnsupportedGrantTypeException(errorMessage);
- }
- else if ("unsupported_response_type".equals(errorCode)) {
- ex = new UnsupportedResponseTypeException(errorMessage);
- }
- else if ("access_denied".equals(errorCode)) {
- ex = new UserDeniedAuthorizationException(errorMessage);
- }
- else if ("insufficient_scope".equals(errorCode)) {
- ex = new InsufficientScopeException(errorMessage, OAuth2Utils.parseParameterList((String) errorParams
- .get("scope")));
- }
- else {
- ex = new OAuth2Exception(errorMessage);
- }
-
- Set> entries = errorParams.entrySet();
- for (Map.Entry entry : entries) {
- String key = entry.getKey();
- if (!"error".equals(key) && !"error_description".equals(key)) {
- Object value = entry.getValue();
- ex.addAdditionalInformation(key, value == null ? null : value.toString());
- }
- }
-
- return ex;
-
- }
-
-}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson1Serializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson1Serializer.java
deleted file mode 100644
index 6ebeb13a6..000000000
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson1Serializer.java
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright 2006-2011 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
- */
-package org.springframework.security.oauth2.common.exceptions;
-
-import java.io.IOException;
-import java.util.Map.Entry;
-
-import org.codehaus.jackson.JsonGenerator;
-import org.codehaus.jackson.JsonProcessingException;
-import org.codehaus.jackson.map.JsonSerializer;
-import org.codehaus.jackson.map.SerializerProvider;
-
-/**
- * @author Dave Syer
- *
- */
-public class OAuth2ExceptionJackson1Serializer extends JsonSerializer {
-
- @Override
- public void serialize(OAuth2Exception value, JsonGenerator jgen, SerializerProvider provider) throws IOException,
- JsonProcessingException {
- jgen.writeStartObject();
- jgen.writeStringField("error", value.getOAuth2ErrorCode());
- jgen.writeStringField("error_description", value.getMessage());
- if (value.getAdditionalInformation()!=null) {
- for (Entry entry : value.getAdditionalInformation().entrySet()) {
- String key = entry.getKey();
- String add = entry.getValue();
- jgen.writeStringField(key, add);
- }
- }
- jgen.writeEndObject();
- }
-
-}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Deserializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Deserializer.java
index 516f39f41..0cd8dbba1 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Deserializer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Deserializer.java
@@ -27,10 +27,14 @@
import org.springframework.security.oauth2.common.util.OAuth2Utils;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Brian Clozel
*
*/
@SuppressWarnings("serial")
+@Deprecated
public class OAuth2ExceptionJackson2Deserializer extends StdDeserializer {
public OAuth2ExceptionJackson2Deserializer() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Serializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Serializer.java
index 2ab32c8cc..0ed45881d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Serializer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/OAuth2ExceptionJackson2Serializer.java
@@ -21,9 +21,13 @@
import com.fasterxml.jackson.databind.ser.std.StdSerializer;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Brian Clozel
*
*/
+@Deprecated
public class OAuth2ExceptionJackson2Serializer extends StdSerializer {
public OAuth2ExceptionJackson2Serializer() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/RedirectMismatchException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/RedirectMismatchException.java
index 4e66b52f2..989980291 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/RedirectMismatchException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/RedirectMismatchException.java
@@ -1,9 +1,13 @@
package org.springframework.security.oauth2.common.exceptions;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class RedirectMismatchException extends ClientAuthenticationException {
public RedirectMismatchException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/SerializationException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/SerializationException.java
index 2b46c26eb..14d41a53f 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/SerializationException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/SerializationException.java
@@ -3,9 +3,13 @@
/**
* Thrown during a problem serialization/deserialization.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class SerializationException extends RuntimeException {
public SerializationException() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnapprovedClientAuthenticationException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnapprovedClientAuthenticationException.java
index f288bc679..1a787bffd 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnapprovedClientAuthenticationException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnapprovedClientAuthenticationException.java
@@ -3,9 +3,13 @@
import org.springframework.security.authentication.InsufficientAuthenticationException;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UnapprovedClientAuthenticationException extends InsufficientAuthenticationException {
public UnapprovedClientAuthenticationException(String msg) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedClientException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedClientException.java
index cb25b01d5..595fe52eb 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedClientException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedClientException.java
@@ -2,10 +2,14 @@
/**
* Exception thrown when a client was unable to authenticate.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UnauthorizedClientException extends ClientAuthenticationException {
public UnauthorizedClientException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedUserException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedUserException.java
index 795fe2d1a..ba0ebf466 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedUserException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnauthorizedUserException.java
@@ -2,10 +2,14 @@
/**
* Exception thrown when a user was unable to authenticate.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*/
@SuppressWarnings("serial")
+@Deprecated
public class UnauthorizedUserException extends OAuth2Exception {
public UnauthorizedUserException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedGrantTypeException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedGrantTypeException.java
index 113c7fefb..4fba4ff0a 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedGrantTypeException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedGrantTypeException.java
@@ -1,9 +1,13 @@
package org.springframework.security.oauth2.common.exceptions;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UnsupportedGrantTypeException extends OAuth2Exception {
public UnsupportedGrantTypeException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedResponseTypeException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedResponseTypeException.java
index 8129964ac..588600f88 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedResponseTypeException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UnsupportedResponseTypeException.java
@@ -1,9 +1,13 @@
package org.springframework.security.oauth2.common.exceptions;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UnsupportedResponseTypeException extends OAuth2Exception {
public UnsupportedResponseTypeException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UserDeniedAuthorizationException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UserDeniedAuthorizationException.java
index 0ec3cc75c..94715b6e7 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UserDeniedAuthorizationException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/exceptions/UserDeniedAuthorizationException.java
@@ -1,9 +1,13 @@
package org.springframework.security.oauth2.common.exceptions;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
@SuppressWarnings("serial")
+@Deprecated
public class UserDeniedAuthorizationException extends OAuth2Exception {
public UserDeniedAuthorizationException(String msg, Throwable t) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/DefaultJdbcListFactory.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/DefaultJdbcListFactory.java
index 37347befe..61a397fbc 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/DefaultJdbcListFactory.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/DefaultJdbcListFactory.java
@@ -23,9 +23,13 @@
import org.springframework.jdbc.core.namedparam.NamedParameterJdbcOperations;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class DefaultJdbcListFactory implements JdbcListFactory {
private final NamedParameterJdbcOperations jdbcTemplate;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/DefaultSerializationStrategy.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/DefaultSerializationStrategy.java
new file mode 100644
index 000000000..f8ade4824
--- /dev/null
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/DefaultSerializationStrategy.java
@@ -0,0 +1,92 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.oauth2.common.util;
+
+import org.springframework.core.ConfigurableObjectInputStream;
+
+import java.io.*;
+
+/**
+ * The default {@link SerializationStrategy} which uses the built-in Java serialization mechanism.
+ *
+ * Note that this class should not be used if data for deserialization comes from an untrusted source.
+ * Instead, please use {@link WhitelistedSerializationStrategy} with a list of allowed classes for deserialization.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ * @author Artem Smotrakov
+ * @since 2.4
+ */
+@Deprecated
+public class DefaultSerializationStrategy implements SerializationStrategy {
+
+ public byte[] serialize(Object state) {
+ ObjectOutputStream oos = null;
+ try {
+ ByteArrayOutputStream bos = new ByteArrayOutputStream(512);
+ oos = new ObjectOutputStream(bos);
+ oos.writeObject(state);
+ oos.flush();
+ return bos.toByteArray();
+ } catch (IOException e) {
+ throw new IllegalArgumentException(e);
+ } finally {
+ if (oos != null) {
+ try {
+ oos.close();
+ } catch (IOException e) {
+ // eat it
+ }
+ }
+ }
+ }
+
+ public T deserialize(byte[] byteArray) {
+ ObjectInputStream oip = null;
+ try {
+ oip = createObjectInputStream(byteArray);
+ @SuppressWarnings("unchecked")
+ T result = (T) oip.readObject();
+ return result;
+ } catch (IOException e) {
+ throw new IllegalArgumentException(e);
+ } catch (ClassNotFoundException e) {
+ throw new IllegalArgumentException(e);
+ } finally {
+ if (oip != null) {
+ try {
+ oip.close();
+ } catch (IOException e) {
+ // eat it
+ }
+ }
+ }
+ }
+
+ /**
+ * Creates an {@link ObjectInputStream} for deserialization.
+ *
+ * @param byteArray Data to be deserialized.
+ * @return An instance of {@link ObjectInputStream} which should be used for deserialization.
+ * @throws IOException If something went wrong.
+ */
+ protected ObjectInputStream createObjectInputStream(byte[] byteArray) throws IOException {
+ return new ConfigurableObjectInputStream(new ByteArrayInputStream(byteArray),
+ Thread.currentThread().getContextClassLoader());
+ }
+}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/Jackson2JsonParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/Jackson2JsonParser.java
index e8ca0adfb..6537d0304 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/Jackson2JsonParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/Jackson2JsonParser.java
@@ -20,9 +20,13 @@
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class Jackson2JsonParser implements JsonParser {
private ObjectMapper mapper = new ObjectMapper();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JacksonJsonParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JacksonJsonParser.java
deleted file mode 100644
index a79502e52..000000000
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JacksonJsonParser.java
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * Copyright 2013-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- *
- * https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
- * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations under the License.
- */
-
-package org.springframework.security.oauth2.common.util;
-
-import java.util.Map;
-
-import org.codehaus.jackson.map.ObjectMapper;
-
-/**
- * @author Dave Syer
- *
- */
-public class JacksonJsonParser implements JsonParser {
-
- private ObjectMapper mapper = new ObjectMapper();
-
- @SuppressWarnings("unchecked")
- @Override
- public Map parseMap(String json) {
- try {
- return mapper.readValue(json, Map.class);
- }
- catch (Exception e) {
- throw new IllegalArgumentException("Cannot parse json", e);
- }
- }
-
- @Override
- public String formatMap(Map map) {
- try {
- return mapper.writeValueAsString(map);
- }
- catch (Exception e) {
- throw new IllegalArgumentException("Cannot format json", e);
- }
- }
-
-}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JdbcListFactory.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JdbcListFactory.java
index fb7492b60..9c5b11cfe 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JdbcListFactory.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JdbcListFactory.java
@@ -22,9 +22,13 @@
import org.springframework.jdbc.core.RowMapper;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface JdbcListFactory {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateDeserializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateDeserializer.java
index c17125c7d..a2b1a9705 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateDeserializer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateDeserializer.java
@@ -1,40 +1,47 @@
/*
- * Cloud Foundry 2012.02.03 Beta
- * Copyright (c) [2009-2012] VMware, Inc. All Rights Reserved.
+ * Copyright 2002-2019 the original author or authors.
*
- * This product is licensed to you under the Apache License, Version 2.0 (the "License").
- * You may not use this product except in compliance with the License.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
*
- * This product includes a number of subcomponents with
- * separate copyright notices and license terms. Your use of these
- * subcomponents is subject to the terms and conditions of the
- * subcomponent's license, as noted in the LICENSE file.
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
*/
-package org.springframework.security.oauth2.common.util;
-import org.codehaus.jackson.JsonParseException;
-import org.codehaus.jackson.JsonParser;
-import org.codehaus.jackson.JsonProcessingException;
-import org.codehaus.jackson.map.DeserializationContext;
-import org.codehaus.jackson.map.JsonDeserializer;
+package org.springframework.security.oauth2.common.util;
import java.io.IOException;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.Date;
+import com.fasterxml.jackson.core.JsonParseException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.DeserializationContext;
+import com.fasterxml.jackson.databind.JsonDeserializer;
+
/**
* JSON deserializer for Jackson to handle regular date instances as timestamps in ISO format.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class JsonDateDeserializer extends JsonDeserializer {
private static final SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
@Override
- public Date deserialize(JsonParser parser, DeserializationContext context) throws IOException, JsonProcessingException {
+ public Date deserialize(com.fasterxml.jackson.core.JsonParser parser, DeserializationContext context) throws IOException, JsonProcessingException {
try {
synchronized (dateFormat) {
return dateFormat.parse(parser.getText());
@@ -44,5 +51,4 @@ public Date deserialize(JsonParser parser, DeserializationContext context) throw
throw new JsonParseException("Could not parse date", parser.getCurrentLocation(), e);
}
}
-
}
\ No newline at end of file
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateSerializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateSerializer.java
index d4df5c793..11fea8daf 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateSerializer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonDateSerializer.java
@@ -1,32 +1,40 @@
/*
- * Cloud Foundry 2012.02.03 Beta
- * Copyright (c) [2009-2012] VMware, Inc. All Rights Reserved.
+ * Copyright 2002-2019 the original author or authors.
*
- * This product is licensed to you under the Apache License, Version 2.0 (the "License").
- * You may not use this product except in compliance with the License.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
*
- * This product includes a number of subcomponents with
- * separate copyright notices and license terms. Your use of these
- * subcomponents is subject to the terms and conditions of the
- * subcomponent's license, as noted in the LICENSE file.
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
*/
-package org.springframework.security.oauth2.common.util;
-import org.codehaus.jackson.JsonGenerator;
-import org.codehaus.jackson.JsonProcessingException;
-import org.codehaus.jackson.map.JsonSerializer;
-import org.codehaus.jackson.map.SerializerProvider;
+package org.springframework.security.oauth2.common.util;
import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Date;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+
/**
* JSON serializer for Jackson to handle regular date instances as timestamps in ISO format.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class JsonDateSerializer extends JsonSerializer {
private static final SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParser.java
index c2905ca5c..be1e0cc58 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParser.java
@@ -16,9 +16,13 @@
import java.util.Map;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface JsonParser {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParserFactory.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParserFactory.java
index 2ec9aa2da..aeadcbd7d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParserFactory.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/JsonParserFactory.java
@@ -16,19 +16,20 @@
import org.springframework.util.ClassUtils;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class JsonParserFactory {
public static JsonParser create() {
if (ClassUtils.isPresent("com.fasterxml.jackson.databind.ObjectMapper", null)) {
return new Jackson2JsonParser();
}
- if (ClassUtils.isPresent("org.codehaus.jackson.map.ObjectMapper", null)) {
- return new JacksonJsonParser();
- }
- throw new IllegalStateException("No Jackson parser found. Please add Jackson to your classpath.");
+ throw new IllegalStateException("No Jackson 2 parser found. Please add Jackson 2 to your classpath.");
}
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/OAuth2Utils.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/OAuth2Utils.java
index 4c22f34b3..ba9988362 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/OAuth2Utils.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/OAuth2Utils.java
@@ -27,9 +27,13 @@
import org.springframework.util.StringUtils;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public abstract class OAuth2Utils {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/ProxyCreator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/ProxyCreator.java
index b842648c7..c3562bf52 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/ProxyCreator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/ProxyCreator.java
@@ -21,9 +21,13 @@
import org.springframework.beans.factory.ObjectFactory;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ProxyCreator {
@SuppressWarnings("unchecked")
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/RandomValueStringGenerator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/RandomValueStringGenerator.java
index 6dd551d42..33a3791ae 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/RandomValueStringGenerator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/RandomValueStringGenerator.java
@@ -1,3 +1,18 @@
+/*
+ * Copyright 2012-2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
package org.springframework.security.oauth2.common.util;
import java.security.SecureRandom;
@@ -5,13 +20,17 @@
/**
* Utility that generates a random-value ASCII string.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class RandomValueStringGenerator {
- private static final char[] DEFAULT_CODEC = "1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+ private static final char[] DEFAULT_CODEC = "1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_"
.toCharArray();
private Random random = new SecureRandom();
@@ -43,7 +62,7 @@ public String generate() {
/**
* Convert these random bytes to a verifier string. The length of the byte array can be
* {@link #setLength(int) configured}. The default implementation mods the bytes to fit into the
- * ASCII letters 1-9, A-Z, a-z .
+ * ASCII letters 1-9, A-Z, a-z, -_ .
*
* @param verifierBytes The bytes.
* @return The string.
@@ -66,11 +85,14 @@ public void setRandom(Random random) {
}
/**
- * The length of string to generate.
+ * The length of string to generate. A length less than or equal to 0 will result in an {@code IllegalArgumentException}.
*
* @param length the length to set
*/
public void setLength(int length) {
+ if (length <= 0) {
+ throw new IllegalArgumentException("length must be greater than 0");
+ }
this.length = length;
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationStrategy.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationStrategy.java
new file mode 100644
index 000000000..72f9f6060
--- /dev/null
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationStrategy.java
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.oauth2.common.util;
+
+/**
+ * Defines how objects are serialized and deserialized.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ * @author Artem Smotrakov
+ * @since 2.4
+ */
+@Deprecated
+public interface SerializationStrategy {
+
+ /**
+ * Serializes an object.
+ *
+ * @param object The object to be serialized.
+ * @return A byte array.
+ */
+ byte[] serialize(Object object);
+
+ /**
+ * Deserializes an object from a byte array.
+ *
+ * @param byteArray The byte array.
+ * @param The type of the object.
+ * @return The deserialized object.
+ */
+ T deserialize(byte[] byteArray);
+
+}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationUtils.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationUtils.java
index e622c6797..fe554e88e 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationUtils.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationUtils.java
@@ -1,64 +1,80 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
package org.springframework.security.oauth2.common.util;
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
+import org.springframework.core.io.support.SpringFactoriesLoader;
+import org.springframework.util.Assert;
-import org.springframework.core.ConfigurableObjectInputStream;
+import java.util.List;
+/**
+ * This is a helper class for serializing and deserializing objects with a {@link SerializationStrategy}.
+ * The class looks for the strategy in {@code META-INF/spring.factories},
+ * or the strategy can also be set by calling {@link #setSerializationStrategy(SerializationStrategy)}.
+ * If no strategy is specified, the default is {@link DefaultSerializationStrategy}.
+ *
+ * Note that the default strategy allows deserializing arbitrary classes which may result in security problems
+ * if data comes from an untrusted source. To prevent possible issues, use {@link WhitelistedSerializationStrategy}
+ * with a list of allowed classes for deserialization.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
+@Deprecated
public class SerializationUtils {
- public static byte[] serialize(Object state) {
- ObjectOutputStream oos = null;
- try {
- ByteArrayOutputStream bos = new ByteArrayOutputStream(512);
- oos = new ObjectOutputStream(bos);
- oos.writeObject(state);
- oos.flush();
- return bos.toByteArray();
- }
- catch (IOException e) {
- throw new IllegalArgumentException(e);
- }
- finally {
- if (oos != null) {
- try {
- oos.close();
- }
- catch (IOException e) {
- // eat it
- }
- }
- }
- }
+ private static SerializationStrategy strategy = new DefaultSerializationStrategy();
+
+ static {
+ List strategies = SpringFactoriesLoader.loadFactories(
+ SerializationStrategy.class, SerializationUtils.class.getClassLoader());
+ if (strategies.size() > 1) {
+ throw new IllegalArgumentException(
+ "Too many serialization strategies in META-INF/spring.factories");
+ }
+ if (strategies.size() == 1) {
+ strategy = strategies.get(0);
+ }
+ }
+
+ /**
+ * @return The current serialization strategy.
+ */
+ public static SerializationStrategy getSerializationStrategy() {
+ return strategy;
+ }
+
+ /**
+ * Sets a new serialization strategy.
+ *
+ * @param serializationStrategy The serialization strategy.
+ */
+ public static void setSerializationStrategy(SerializationStrategy serializationStrategy) {
+ Assert.notNull(serializationStrategy, "serializationStrategy cannot be null");
+ strategy = serializationStrategy;
+ }
+
+ public static byte[] serialize(Object object) {
+ return strategy.serialize(object);
+ }
- public static T deserialize(byte[] byteArray) {
- ObjectInputStream oip = null;
- try {
- oip = new ConfigurableObjectInputStream(new ByteArrayInputStream(byteArray),
- Thread.currentThread().getContextClassLoader());
- @SuppressWarnings("unchecked")
- T result = (T) oip.readObject();
- return result;
- }
- catch (IOException e) {
- throw new IllegalArgumentException(e);
- }
- catch (ClassNotFoundException e) {
- throw new IllegalArgumentException(e);
- }
- finally {
- if (oip != null) {
- try {
- oip.close();
- }
- catch (IOException e) {
- // eat it
- }
- }
- }
- }
+ public static T deserialize(byte[] byteArray) {
+ return strategy.deserialize(byteArray);
+ }
-}
+}
\ No newline at end of file
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/WhitelistedSerializationStrategy.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/WhitelistedSerializationStrategy.java
new file mode 100644
index 000000000..f4a32ba3b
--- /dev/null
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/WhitelistedSerializationStrategy.java
@@ -0,0 +1,147 @@
+/*
+ * Copyright 2012-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.oauth2.common.util;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.NotSerializableException;
+import java.io.ObjectInputStream;
+import java.io.ObjectStreamClass;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.springframework.util.ClassUtils;
+
+/**
+ * A {@link SerializationStrategy} which uses a whitelist of allowed classes for deserialization.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ * @author Artem Smotrakov
+ * @since 2.4
+ */
+@Deprecated
+public class WhitelistedSerializationStrategy extends DefaultSerializationStrategy {
+
+ /**
+ * A list of classes which are allowed to deserialize by default.
+ */
+ private static final List DEFAULT_ALLOWED_CLASSES;
+
+ static {
+ List classes = new ArrayList();
+ classes.add("java.lang.");
+ classes.add("java.util.");
+ classes.add("org.springframework.security.");
+ DEFAULT_ALLOWED_CLASSES = Collections.unmodifiableList(classes);
+ }
+
+ /**
+ * A list of classes which are allowed to deserialize.
+ */
+ private final List allowedClasses;
+
+ /**
+ * Initializes {@link WhitelistedSerializationStrategy} with the list of classes
+ * which are allowed to deserialize by default.
+ */
+ public WhitelistedSerializationStrategy() {
+ this(DEFAULT_ALLOWED_CLASSES);
+ }
+
+ /**
+ * Initializes {@link WhitelistedSerializationStrategy} with specified allowed classes.
+ *
+ * @param allowedClasses The allowed classes for deserialization.
+ */
+ public WhitelistedSerializationStrategy(List allowedClasses) {
+ this.allowedClasses = Collections.unmodifiableList(allowedClasses);
+ }
+
+ protected ObjectInputStream createObjectInputStream(byte[] byteArray) throws IOException {
+ return new WhitelistedObjectInputStream(new ByteArrayInputStream(byteArray),
+ Thread.currentThread().getContextClassLoader(), allowedClasses);
+ }
+
+ /**
+ * Special ObjectInputStream subclass that checks if classes are allowed to deserialize. The class
+ * should be configured with a whitelist of only allowed (safe) classes to deserialize.
+ */
+ private static class WhitelistedObjectInputStream extends ObjectInputStream {
+
+ /**
+ * The list of classes which are allowed for deserialization.
+ */
+ private final List allowedClasses;
+
+ /**
+ * The class loader to use for loading local classes.
+ */
+ private final ClassLoader classLoader;
+
+ /**
+ * Create a new WhitelistedObjectInputStream for the given InputStream, class loader and
+ * allowed class names.
+ *
+ * @param in The InputStream to read from.
+ * @param classLoader The ClassLoader to use for loading local classes.
+ * @param allowedClasses The list of allowed classes for deserialization.
+ * @throws IOException If something went wrong.
+ */
+ private WhitelistedObjectInputStream(InputStream in, ClassLoader classLoader, List allowedClasses)
+ throws IOException {
+ super(in);
+ this.classLoader = classLoader;
+ this.allowedClasses = Collections.unmodifiableList(allowedClasses);
+ }
+
+ /**
+ * Resolve the class only if it's allowed to deserialize.
+ *
+ * @see ObjectInputStream#resolveClass(ObjectStreamClass)
+ */
+ @Override
+ protected Class resolveClass(ObjectStreamClass classDesc)
+ throws IOException, ClassNotFoundException {
+ if (isProhibited(classDesc.getName())) {
+ throw new NotSerializableException("Not allowed to deserialize " + classDesc.getName());
+ }
+ if (this.classLoader != null) {
+ return ClassUtils.forName(classDesc.getName(), this.classLoader);
+ }
+ return super.resolveClass(classDesc);
+ }
+
+ /**
+ * Check if the class is allowed to be deserialized.
+ *
+ * @param className The class to check.
+ * @return True if the class is not allowed to be deserialized, false otherwise.
+ */
+ private boolean isProhibited(String className) {
+ for (String allowedClass : this.allowedClasses) {
+ if (className.startsWith(allowedClass)) {
+ return false;
+ }
+ }
+ return true;
+ }
+ }
+}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/ClientDetailsServiceBuilder.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/ClientDetailsServiceBuilder.java
index a47b3608c..5296f1a55 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/ClientDetailsServiceBuilder.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/ClientDetailsServiceBuilder.java
@@ -34,10 +34,14 @@
/**
* Builder for OAuth2 client details service. Can be used to construct either an in-memory or a JDBC implementation of
* the {@link ClientDetailsService} and populate it with data.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ClientDetailsServiceBuilder> extends
SecurityConfigurerAdapter implements SecurityBuilder {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/InMemoryClientDetailsServiceBuilder.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/InMemoryClientDetailsServiceBuilder.java
index 8c6f37c3a..f5ff55989 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/InMemoryClientDetailsServiceBuilder.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/InMemoryClientDetailsServiceBuilder.java
@@ -23,9 +23,13 @@
import org.springframework.security.oauth2.provider.client.InMemoryClientDetailsService;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class InMemoryClientDetailsServiceBuilder extends
ClientDetailsServiceBuilder {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/JdbcClientDetailsServiceBuilder.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/JdbcClientDetailsServiceBuilder.java
index 4a9d26a87..af9d2cc8a 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/JdbcClientDetailsServiceBuilder.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/builders/JdbcClientDetailsServiceBuilder.java
@@ -27,9 +27,13 @@
import org.springframework.util.Assert;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class JdbcClientDetailsServiceBuilder extends ClientDetailsServiceBuilder {
private Set clientDetails = new HashSet();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configuration/ClientDetailsServiceConfiguration.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configuration/ClientDetailsServiceConfiguration.java
index d7ad2e699..da4f0a251 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configuration/ClientDetailsServiceConfiguration.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configuration/ClientDetailsServiceConfiguration.java
@@ -25,10 +25,14 @@
import org.springframework.security.oauth2.provider.ClientDetailsService;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Rob Winch
*
*/
@Configuration
+@Deprecated
public class ClientDetailsServiceConfiguration {
@SuppressWarnings("rawtypes")
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configurers/ClientDetailsServiceConfigurer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configurers/ClientDetailsServiceConfigurer.java
index e1ec33053..84a080b08 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configurers/ClientDetailsServiceConfigurer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/configurers/ClientDetailsServiceConfigurer.java
@@ -24,9 +24,13 @@
import org.springframework.security.oauth2.provider.ClientDetailsService;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Rob Winch
*
*/
+@Deprecated
public class ClientDetailsServiceConfigurer extends
SecurityConfigurerAdapter> {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurer.java
index f81dfc06c..3e01c32ce 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurer.java
@@ -22,10 +22,14 @@
/**
* Convenient strategy for configuring an OAUth2 Authorization Server. Beans of this type are applied to the Spring
* context automatically if you {@link EnableAuthorizationServer @EnableAuthorizationServer}.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface AuthorizationServerConfigurer {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurerAdapter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurerAdapter.java
index 4e8342ac1..9e5e3d537 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurerAdapter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerConfigurerAdapter.java
@@ -18,9 +18,13 @@
import org.springframework.security.oauth2.config.annotation.web.configurers.AuthorizationServerSecurityConfigurer;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class AuthorizationServerConfigurerAdapter implements AuthorizationServerConfigurer {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerEndpointsConfiguration.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerEndpointsConfiguration.java
index aa32758a5..ccc18971d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerEndpointsConfiguration.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerEndpointsConfiguration.java
@@ -57,11 +57,15 @@
import org.springframework.stereotype.Component;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@Configuration
@Import(TokenKeyEndpointRegistrar.class)
+@Deprecated
public class AuthorizationServerEndpointsConfiguration {
private AuthorizationServerEndpointsConfigurer endpoints = new AuthorizationServerEndpointsConfigurer();
@@ -78,7 +82,7 @@ public void init() {
try {
configurer.configure(endpoints);
} catch (Exception e) {
- throw new IllegalStateException("Cannot configure enpdoints", e);
+ throw new IllegalStateException("Cannot configure endpoints", e);
}
}
endpoints.setClientDetailsService(clientDetailsService);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerSecurityConfiguration.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerSecurityConfiguration.java
index cc7601d03..a95b4bcf3 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerSecurityConfiguration.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/AuthorizationServerSecurityConfiguration.java
@@ -34,6 +34,9 @@
import java.util.List;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Rob Winch
* @author Dave Syer
*
@@ -41,6 +44,7 @@
@Configuration
@Order(0)
@Import({ ClientDetailsServiceConfiguration.class, AuthorizationServerEndpointsConfiguration.class })
+@Deprecated
public class AuthorizationServerSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableAuthorizationServer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableAuthorizationServer.java
index 1b4415269..68ce85496 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableAuthorizationServer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableAuthorizationServer.java
@@ -35,7 +35,10 @@
* @EnableWebSecurity} etc.), but the Token Endpoint (/oauth/token) will be automatically secured using HTTP Basic
* authentication on the client's credentials. Clients must be registered by providing a
* {@link ClientDetailsService} through one or more AuthorizationServerConfigurers.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@@ -43,6 +46,7 @@
@Retention(RetentionPolicy.RUNTIME)
@Documented
@Import({AuthorizationServerEndpointsConfiguration.class, AuthorizationServerSecurityConfiguration.class})
+@Deprecated
public @interface EnableAuthorizationServer {
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableOAuth2Client.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableOAuth2Client.java
index 3bac72c3c..2b6a2c933 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableOAuth2Client.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableOAuth2Client.java
@@ -49,7 +49,10 @@
* token when necessary. Apps that use password grants need to set the authentication properties in the
* OAuth2ProtectedResourceDetails before using the RestOperations, and this means the resource details themselves also
* have to be per session (assuming there are multiple users in the system).
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@@ -57,6 +60,7 @@
@Retention(RetentionPolicy.RUNTIME)
@Documented
@Import(OAuth2ClientConfiguration.class)
+@Deprecated
public @interface EnableOAuth2Client {
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableResourceServer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableResourceServer.java
index 52c532833..7ceef0307 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableResourceServer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/EnableResourceServer.java
@@ -36,7 +36,10 @@
* The annotation creates a {@link WebSecurityConfigurerAdapter} with a hard-coded {@link Order} (of 3). It's not
* possible to change the order right now owing to technical limitations in Spring, so you must avoid using order=3 in
* other WebSecurityConfigurerAdapters in your application (Spring Security will let you know if you forget).
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@@ -44,6 +47,7 @@
@Retention(RetentionPolicy.RUNTIME)
@Documented
@Import(ResourceServerConfiguration.class)
+@Deprecated
public @interface EnableResourceServer {
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/OAuth2ClientConfiguration.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/OAuth2ClientConfiguration.java
index b79985202..a618d95ba 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/OAuth2ClientConfiguration.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/OAuth2ClientConfiguration.java
@@ -30,10 +30,14 @@
import org.springframework.security.oauth2.client.token.DefaultAccessTokenRequest;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@Configuration
+@Deprecated
public class OAuth2ClientConfiguration {
@Bean
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfiguration.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfiguration.java
index 1833fab9f..9e1224846 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfiguration.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfiguration.java
@@ -40,10 +40,14 @@
import org.springframework.util.ReflectionUtils;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@Configuration
+@Deprecated
public class ResourceServerConfiguration extends WebSecurityConfigurerAdapter implements Ordered {
private int order = 3;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurer.java
index d2a60f747..490e01562 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurer.java
@@ -23,10 +23,14 @@
* rules and paths that are protected by OAuth2 security. Applications may provide multiple instances of this interface,
* and in general (like with other Security configurers), if more than one configures the same property, then the last
* one wins. The configurers are sorted by {@link Order} before being applied.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface ResourceServerConfigurer {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurerAdapter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurerAdapter.java
index 2cf23e139..cea39d37b 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurerAdapter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configuration/ResourceServerConfigurerAdapter.java
@@ -16,9 +16,13 @@
import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ResourceServerConfigurerAdapter implements ResourceServerConfigurer {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerEndpointsConfigurer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerEndpointsConfigurer.java
index 9bb56fa2a..6785fb430 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerEndpointsConfigurer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerEndpointsConfigurer.java
@@ -81,11 +81,15 @@
/**
* Configure the properties and enhanced functionality of the Authorization Server endpoints.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Rob Winch
* @author Dave Syer
* @since 2.0
*/
+@Deprecated
public final class AuthorizationServerEndpointsConfigurer {
private AuthorizationServerTokenServices tokenServices;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerSecurityConfigurer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerSecurityConfigurer.java
index 80b5d9cd3..c0962ac73 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerSecurityConfigurer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/AuthorizationServerSecurityConfigurer.java
@@ -22,7 +22,10 @@
import javax.servlet.Filter;
import org.springframework.http.MediaType;
+import org.springframework.security.authentication.AuthenticationEventPublisher;
import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.SecurityConfigurerAdapter;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -47,11 +50,15 @@
import org.springframework.web.accept.HeaderContentNegotiationStrategy;
/**
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Rob Winch
* @author Dave Syer
* @since 2.0
*/
+@Deprecated
public final class AuthorizationServerSecurityConfigurer extends
SecurityConfigurerAdapter {
@@ -76,7 +83,11 @@ public final class AuthorizationServerSecurityConfigurer extends
* BasicAuthenticationFilter.
*/
private List tokenEndpointAuthenticationFilters = new ArrayList();
-
+
+ private List authenticationProviders = new ArrayList();
+
+ private AuthenticationEventPublisher authenticationEventPublisher;
+
public AuthorizationServerSecurityConfigurer sslOnly() {
this.sslOnly = true;
return this;
@@ -108,6 +119,29 @@ public AuthorizationServerSecurityConfigurer accessDeniedHandler(AccessDeniedHan
return this;
}
+ /**
+ * Authentication provider(s) to use with the {@link AuthenticationManager}.
+ * Adding an authentication provider here will replace the default {@link DaoAuthenticationProvider}.
+ *
+ * @param authenticationProvider the authentication provider to add
+ */
+ public AuthorizationServerSecurityConfigurer addAuthenticationProvider(AuthenticationProvider authenticationProvider) {
+ Assert.notNull(authenticationProvider, "authenticationProvider must not be null");
+ this.authenticationProviders.add(authenticationProvider);
+ return this;
+ }
+
+ /**
+ * {@link AuthenticationEventPublisher} to use with the {@link AuthenticationManager}.
+ *
+ * @param authenticationEventPublisher the {@link AuthenticationEventPublisher} to use
+ */
+ public AuthorizationServerSecurityConfigurer authenticationEventPublisher(AuthenticationEventPublisher authenticationEventPublisher) {
+ Assert.notNull(authenticationEventPublisher, "authenticationEventPublisher must not be null");
+ this.authenticationEventPublisher = authenticationEventPublisher;
+ return this;
+ }
+
public AuthorizationServerSecurityConfigurer tokenKeyAccess(String tokenKeyAccess) {
this.tokenKeyAccess = tokenKeyAccess;
return this;
@@ -128,17 +162,22 @@ public String getCheckTokenAccess() {
@Override
public void init(HttpSecurity http) throws Exception {
-
registerDefaultAuthenticationEntryPoint(http);
- if (passwordEncoder != null) {
- ClientDetailsUserDetailsService clientDetailsUserDetailsService = new ClientDetailsUserDetailsService(clientDetailsService());
- clientDetailsUserDetailsService.setPasswordEncoder(passwordEncoder());
- http.getSharedObject(AuthenticationManagerBuilder.class)
- .userDetailsService(clientDetailsUserDetailsService)
- .passwordEncoder(passwordEncoder());
+ AuthenticationManagerBuilder builder = http.getSharedObject(AuthenticationManagerBuilder.class);
+ if (authenticationEventPublisher != null) {
+ builder.authenticationEventPublisher(authenticationEventPublisher);
}
- else {
- http.userDetailsService(new ClientDetailsUserDetailsService(clientDetailsService()));
+ if (authenticationProviders.isEmpty()) {
+ if (passwordEncoder != null) {
+ builder.userDetailsService(new ClientDetailsUserDetailsService(clientDetailsService()))
+ .passwordEncoder(passwordEncoder());
+ } else {
+ builder.userDetailsService(new ClientDetailsUserDetailsService(clientDetailsService()));
+ }
+ } else {
+ for (AuthenticationProvider provider: authenticationProviders) {
+ builder.authenticationProvider(provider);
+ }
}
http.securityContext().securityContextRepository(new NullSecurityContextRepository()).and().csrf().disable()
.httpBasic().authenticationEntryPoint(this.authenticationEntryPoint).realmName(realm);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/ResourceServerSecurityConfigurer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/ResourceServerSecurityConfigurer.java
index 7251e85da..e6b6d36b6 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/ResourceServerSecurityConfigurer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/annotation/web/configurers/ResourceServerSecurityConfigurer.java
@@ -50,12 +50,15 @@
import javax.servlet.http.HttpServletRequest;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
*
* @author Rob Winch
* @author Dave Syer
*
* @since 2.0.0
*/
+@Deprecated
public final class ResourceServerSecurityConfigurer extends
SecurityConfigurerAdapter {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/AuthorizationServerBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/AuthorizationServerBeanDefinitionParser.java
index 61047191d..78b15f304 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/AuthorizationServerBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/AuthorizationServerBeanDefinitionParser.java
@@ -41,10 +41,14 @@
/**
* Parser for the OAuth "provider" element.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class AuthorizationServerBeanDefinitionParser
extends ProviderBeanDefinitionParser {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientBeanDefinitionParser.java
index d8034750c..a8796ec2f 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientBeanDefinitionParser.java
@@ -24,10 +24,14 @@
/**
* Parser for the OAuth "client" element supporting client apps using {@link OAuth2RestTemplate}.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class ClientBeanDefinitionParser extends AbstractBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientDetailsServiceBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientDetailsServiceBeanDefinitionParser.java
index 21fe53fe6..e67945547 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientDetailsServiceBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ClientDetailsServiceBeanDefinitionParser.java
@@ -30,9 +30,13 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Andrew McCall
*/
+@Deprecated
public class ClientDetailsServiceBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ConfigUtils.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ConfigUtils.java
index 77fde32c3..fc11e3d9e 100755
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ConfigUtils.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ConfigUtils.java
@@ -22,8 +22,12 @@
/**
* Common place for OAuth namespace configuration utils.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class ConfigUtils {
private static final Method createMatcherMethod3x = ReflectionUtils.findMethod(
MatcherType.class, "createMatcher", String.class, String.class);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ExpressionHandlerBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ExpressionHandlerBeanDefinitionParser.java
index 9b8f9e7f7..fc7880107 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ExpressionHandlerBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ExpressionHandlerBeanDefinitionParser.java
@@ -21,9 +21,13 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class ExpressionHandlerBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2ClientContextFactoryBean.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2ClientContextFactoryBean.java
index 8b8d702c9..dc865ffc0 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2ClientContextFactoryBean.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2ClientContextFactoryBean.java
@@ -23,10 +23,14 @@
* Convenience factory for OAuth2ClientContext that is aware of the need for a different context if the resource is for a
* client credentials grant. Client credentials grants will always have the same credentials for all requests, so
* there's no point protecting the context with session and request scopes.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class OAuth2ClientContextFactoryBean implements FactoryBean {
private OAuth2ProtectedResourceDetails resource;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2SecurityNamespaceHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2SecurityNamespaceHandler.java
index 01210ba8b..b92184402 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2SecurityNamespaceHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/OAuth2SecurityNamespaceHandler.java
@@ -16,9 +16,13 @@
import org.springframework.beans.factory.xml.NamespaceHandlerSupport;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class OAuth2SecurityNamespaceHandler extends NamespaceHandlerSupport {
public void init() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ProviderBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ProviderBeanDefinitionParser.java
index 364c16013..93b16525e 100755
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ProviderBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ProviderBeanDefinitionParser.java
@@ -25,9 +25,13 @@
/**
* Parser for the OAuth "provider" element.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public abstract class ProviderBeanDefinitionParser extends AbstractBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceBeanDefinitionParser.java
index 23c9fc62b..23c76ee29 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceBeanDefinitionParser.java
@@ -36,8 +36,12 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class ResourceBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceServerBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceServerBeanDefinitionParser.java
index d7d261e1e..d6d8d7403 100755
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceServerBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceServerBeanDefinitionParser.java
@@ -24,10 +24,14 @@
/**
* Parser for the OAuth "resource-server" element. Creates a filter that can be added to the standard Spring Security
* filter chain.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class ResourceServerBeanDefinitionParser extends ProviderBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/RestTemplateBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/RestTemplateBeanDefinitionParser.java
index c4aeca280..7054d99df 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/RestTemplateBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/RestTemplateBeanDefinitionParser.java
@@ -25,9 +25,13 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class RestTemplateBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/WebExpressionHandlerBeanDefinitionParser.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/WebExpressionHandlerBeanDefinitionParser.java
index dff530bb3..def339b0d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/WebExpressionHandlerBeanDefinitionParser.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/WebExpressionHandlerBeanDefinitionParser.java
@@ -21,9 +21,13 @@
import org.w3c.dom.Element;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class WebExpressionHandlerBeanDefinitionParser extends AbstractSingleBeanDefinitionParser {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2AccessTokenMessageConverter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2AccessTokenMessageConverter.java
index f64ea48b0..6bdf83f2f 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2AccessTokenMessageConverter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2AccessTokenMessageConverter.java
@@ -28,11 +28,15 @@
/**
* Converter that can handle inbound form data and convert it to an access token. Needed to support external servers,
* like Facebook that might not send JSON token data.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Rob Winch
* @author Dave Syer
*
*/
+@Deprecated
public class FormOAuth2AccessTokenMessageConverter extends AbstractHttpMessageConverter {
private final FormHttpMessageConverter delegateMessageConverter;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2ExceptionHttpMessageConverter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2ExceptionHttpMessageConverter.java
index d81a0ecf7..264a528d5 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2ExceptionHttpMessageConverter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/FormOAuth2ExceptionHttpMessageConverter.java
@@ -31,11 +31,15 @@
/**
* Converter that can handle inbound form data and convert it to an OAuth2 exception. Needed to support external servers,
* like Facebook that might not send JSON data.
- *
-@author Rob Winch
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ * @author Rob Winch
* @author Dave Syer
*
*/
+@Deprecated
public final class FormOAuth2ExceptionHttpMessageConverter implements HttpMessageConverter {
private static final List SUPPORTED_MEDIA = Collections.singletonList(MediaType.APPLICATION_FORM_URLENCODED);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/AbstractJaxbMessageConverter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/AbstractJaxbMessageConverter.java
index 5bc7c0191..6b9e8c418 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/AbstractJaxbMessageConverter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/AbstractJaxbMessageConverter.java
@@ -84,7 +84,7 @@ protected final void writeToResult(E accessToken, HttpHeaders headers, Result re
createMarshaller().marshal(convertedAccessToken, result);
}
catch (MarshalException ex) {
- throw new HttpMessageNotWritableException("Could not marshal [" + accessToken + "]: " + ex.getMessage(), ex);
+ throw new HttpMessageNotWritableException("Could not marshal accessToken: " + ex.getMessage(), ex);
}
catch (JAXBException ex) {
throw new HttpMessageConversionException("Could not instantiate JAXBContext: " + ex.getMessage(), ex);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2AccessTokenMessageConverter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2AccessTokenMessageConverter.java
index be71dafae..ac4e45724 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2AccessTokenMessageConverter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2AccessTokenMessageConverter.java
@@ -19,6 +19,12 @@
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.common.DefaultOAuth2RefreshToken;
+/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
+@Deprecated
public final class JaxbOAuth2AccessTokenMessageConverter extends AbstractJaxbMessageConverter {
public JaxbOAuth2AccessTokenMessageConverter() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2ExceptionMessageConverter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2ExceptionMessageConverter.java
index 72ae1cd6f..3b2f1146b 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2ExceptionMessageConverter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/http/converter/jaxb/JaxbOAuth2ExceptionMessageConverter.java
@@ -14,6 +14,12 @@
import org.springframework.security.oauth2.common.exceptions.OAuth2Exception;
+/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
+@Deprecated
public final class JaxbOAuth2ExceptionMessageConverter extends
AbstractJaxbMessageConverter {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/AuthorizationRequest.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/AuthorizationRequest.java
index ddb90e808..520f66960 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/AuthorizationRequest.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/AuthorizationRequest.java
@@ -30,12 +30,16 @@
* authorization request as a {@link SessionAttributes} member while the end
* user through the authorization process (which may span several page
* requests).
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
* @author Amanda Anganes
*/
@SuppressWarnings("serial")
+@Deprecated
public class AuthorizationRequest extends BaseRequest implements Serializable {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientAlreadyExistsException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientAlreadyExistsException.java
index b7875f603..2459ccd2d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientAlreadyExistsException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientAlreadyExistsException.java
@@ -17,11 +17,15 @@
/**
* Exception indicating that a client registration already exists (e.g. if someone tries to create a duplicate).
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@SuppressWarnings("serial")
+@Deprecated
public class ClientAlreadyExistsException extends ClientRegistrationException {
public ClientAlreadyExistsException(String msg) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetails.java
index f9e8d1c2f..5aacd8917 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetails.java
@@ -9,9 +9,13 @@
/**
* Client details for OAuth 2
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface ClientDetails extends Serializable {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetailsService.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetailsService.java
index f9e4166b9..2137fe459 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetailsService.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientDetailsService.java
@@ -20,8 +20,12 @@
/**
* A service that provides the details about an OAuth2 client.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface ClientDetailsService {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationException.java
index 731577ee5..29d1b6975 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationException.java
@@ -16,10 +16,14 @@
package org.springframework.security.oauth2.provider;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@SuppressWarnings("serial")
+@Deprecated
public class ClientRegistrationException extends RuntimeException {
public ClientRegistrationException(String msg) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationService.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationService.java
index a388c1b5b..d032db2c4 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationService.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/ClientRegistrationService.java
@@ -20,10 +20,14 @@
/**
* Interface for client registration, handling add, update and remove of {@link ClientDetails} from an Authorization
* Server.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface ClientRegistrationService {
void addClientDetails(ClientDetails clientDetails) throws ClientAlreadyExistsException;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/CompositeTokenGranter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/CompositeTokenGranter.java
index fab6fbf89..a880d581d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/CompositeTokenGranter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/CompositeTokenGranter.java
@@ -22,9 +22,13 @@
import org.springframework.security.oauth2.common.OAuth2AccessToken;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class CompositeTokenGranter implements TokenGranter {
private final List tokenGranters;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/DefaultSecurityContextAccessor.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/DefaultSecurityContextAccessor.java
index 46915dc66..deb892923 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/DefaultSecurityContextAccessor.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/DefaultSecurityContextAccessor.java
@@ -23,10 +23,14 @@
/**
* Strategy for accessing useful information about the current security context.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class DefaultSecurityContextAccessor implements SecurityContextAccessor {
@Override
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/NoSuchClientException.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/NoSuchClientException.java
index 0083d4d51..3712afaeb 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/NoSuchClientException.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/NoSuchClientException.java
@@ -16,10 +16,14 @@
package org.springframework.security.oauth2.provider;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
@SuppressWarnings("serial")
+@Deprecated
public class NoSuchClientException extends ClientRegistrationException {
public NoSuchClientException(String msg) {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Authentication.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Authentication.java
index d2f3cf045..d4543c853 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Authentication.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Authentication.java
@@ -7,9 +7,13 @@
/**
* An OAuth 2 authentication token can contain two authentications: one for the client and one for the user. Since some
* OAuth authorization grants don't require user authentication, the user authentication may be null.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class OAuth2Authentication extends AbstractAuthenticationToken {
private static final long serialVersionUID = -4809832298438307309L;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Request.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Request.java
index 61dcd5660..a3d2fbae3 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Request.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2Request.java
@@ -14,11 +14,15 @@
* Represents a stored authorization or token request. Used as part of the OAuth2Authentication object to store a
* request's authentication information. Does not expose public setters so that clients can not mutate state if they
* respect the declared type of the request.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Amanda Anganes
* @author Dave Syer
*
*/
+@Deprecated
public class OAuth2Request extends BaseRequest implements Serializable {
private static final long serialVersionUID = 1L;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestFactory.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestFactory.java
index 278b25b0c..22762e649 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestFactory.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestFactory.java
@@ -17,11 +17,15 @@
/**
* Strategy for managing OAuth2 requests: {@link AuthorizationRequest}, {@link TokenRequest}, {@link OAuth2Request}.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
* @author Amanda Anganes
*
*/
+@Deprecated
public interface OAuth2RequestFactory {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestValidator.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestValidator.java
index b88a765bf..548ab4a6d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestValidator.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/OAuth2RequestValidator.java
@@ -6,10 +6,14 @@
/**
* Validation interface for OAuth2 requests to the {@link AuthorizationEndpoint} and {@link TokenEndpoint}.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Amanda Anganes
*
*/
+@Deprecated
public interface OAuth2RequestValidator {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/SecurityContextAccessor.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/SecurityContextAccessor.java
index cd6522724..c051179f4 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/SecurityContextAccessor.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/SecurityContextAccessor.java
@@ -19,10 +19,14 @@
/**
* Strategy for accessing useful information about the current security context.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface SecurityContextAccessor {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenGranter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenGranter.java
index fcd9ef1f8..7c31f571c 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenGranter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenGranter.java
@@ -21,10 +21,14 @@
/**
* Interface for granters of access tokens. Various grant types are defined in the specification, and each of those has
* an implementation, leaving room for extensions to the specification as needed.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface TokenGranter {
OAuth2AccessToken grant(String grantType, TokenRequest tokenRequest);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenRequest.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenRequest.java
index ebc13a56d..b04919afe 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenRequest.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/TokenRequest.java
@@ -15,12 +15,16 @@
* In the implicit flow, a token is requested through the {@link AuthorizationEndpoint} directly, and in that case the
* {@link AuthorizationRequest} is converted into a {@link TokenRequest} for processing through the token granting
* chain.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Amanda Anganes
* @author Dave Syer
*
*/
@SuppressWarnings("serial")
+@Deprecated
public class TokenRequest extends BaseRequest {
private String grantType;
@@ -90,7 +94,7 @@ public OAuth2Request createOAuth2Request(ClientDetails client) {
modifiable.remove("password");
modifiable.remove("client_secret");
// Add grant type so it can be retrieved from OAuth2Request
- modifiable.put("grant_type", grantType);
+ modifiable.put(OAuth2Utils.GRANT_TYPE, grantType);
return new OAuth2Request(modifiable, client.getClientId(), client.getAuthorities(), true, this.getScope(),
client.getResourceIds(), null, null, null);
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/Approval.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/Approval.java
index 27bbf8262..c9a2503f9 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/Approval.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/Approval.java
@@ -19,18 +19,23 @@
import java.util.Calendar;
import java.util.Date;
-import org.codehaus.jackson.annotate.JsonIgnore;
-import org.codehaus.jackson.map.annotate.JsonDeserialize;
-import org.codehaus.jackson.map.annotate.JsonSerialize;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+
import org.springframework.security.oauth2.common.util.JsonDateDeserializer;
import org.springframework.security.oauth2.common.util.JsonDateSerializer;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
* @author Vidya Val
*
*/
@JsonSerialize(include = JsonSerialize.Inclusion.NON_NULL)
+@Deprecated
public class Approval {
private String userId;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStore.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStore.java
index 88209e612..85a67f4d3 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStore.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStore.java
@@ -19,10 +19,14 @@
/**
* Interface for saving, retrieving and revoking user approvals (per client, per scope).
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface ApprovalStore {
public boolean addApprovals(Collection approvals);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStoreUserApprovalHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStoreUserApprovalHandler.java
index 33804a776..2bda1ae40 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStoreUserApprovalHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/ApprovalStoreUserApprovalHandler.java
@@ -40,10 +40,14 @@
/**
* A user approval handler that remembers approval decisions by consulting existing approvals.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ApprovalStoreUserApprovalHandler implements UserApprovalHandler, InitializingBean {
private static Log logger = LogFactory.getLog(ApprovalStoreUserApprovalHandler.class);
@@ -131,7 +135,7 @@ public AuthorizationRequest checkForPreApproval(AuthorizationRequest authorizati
}
}
catch (ClientRegistrationException e) {
- logger.warn("Client registration problem prevent autoapproval check for client=" + clientId);
+ logger.warn("Client registration problem prevent autoapproval check for client");
}
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/DefaultUserApprovalHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/DefaultUserApprovalHandler.java
index 2344627f5..5aa3813b1 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/DefaultUserApprovalHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/DefaultUserApprovalHandler.java
@@ -25,10 +25,14 @@
/**
* A default user approval handler that doesn't remember any decisions.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class DefaultUserApprovalHandler implements UserApprovalHandler {
private String approvalParameter = OAuth2Utils.USER_OAUTH_APPROVAL;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/InMemoryApprovalStore.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/InMemoryApprovalStore.java
index b70818196..51b765905 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/InMemoryApprovalStore.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/InMemoryApprovalStore.java
@@ -23,9 +23,13 @@
import java.util.concurrent.ConcurrentMap;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class InMemoryApprovalStore implements ApprovalStore {
private ConcurrentMap> map = new ConcurrentHashMap>();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/JdbcApprovalStore.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/JdbcApprovalStore.java
index d200e22ee..11e5bfb7f 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/JdbcApprovalStore.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/JdbcApprovalStore.java
@@ -37,9 +37,13 @@
import org.springframework.util.Assert;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class JdbcApprovalStore implements ApprovalStore {
private final JdbcTemplate jdbcTemplate;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenApprovalStore.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenApprovalStore.java
index e9f0ebb30..2a45946f6 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenApprovalStore.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenApprovalStore.java
@@ -32,10 +32,14 @@
* approvals even if they are not really represented in such a way internally. For full fine-grained control of user
* approvals don't use a TokenStore at all, and don't use this ApprovalStore with Approval-based
* {@link AuthorizationServerTokenServices} implementations.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class TokenApprovalStore implements ApprovalStore {
private TokenStore store;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenStoreUserApprovalHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenStoreUserApprovalHandler.java
index ad69f0d10..8c60bea7f 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenStoreUserApprovalHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/TokenStoreUserApprovalHandler.java
@@ -38,10 +38,14 @@
/**
* A user approval handler that remembers approval decisions by consulting existing tokens.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class TokenStoreUserApprovalHandler implements UserApprovalHandler, InitializingBean {
private static Log logger = LogFactory.getLog(TokenStoreUserApprovalHandler.class);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/UserApprovalHandler.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/UserApprovalHandler.java
index ab741bb2e..e57ebba3d 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/UserApprovalHandler.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/approval/UserApprovalHandler.java
@@ -8,11 +8,15 @@
/**
* Basic interface for determining whether a given client authentication request has been
* approved by the current user.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
* @author Amanda Anganes
*/
+@Deprecated
public interface UserApprovalHandler {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/BearerTokenExtractor.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/BearerTokenExtractor.java
index 4d224556d..a11c6fae9 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/BearerTokenExtractor.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/BearerTokenExtractor.java
@@ -27,10 +27,14 @@
* {@link TokenExtractor} that strips the authenticator from a bearer token request (with an Authorization header in the
* form "Bearer <TOKEN>", or as a request parameter if that fails). The access token is the principal in
* the authentication token that is extracted.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class BearerTokenExtractor implements TokenExtractor {
private final static Log logger = LogFactory.getLog(BearerTokenExtractor.class);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetails.java
index d7a14ce8e..820ef1556 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetails.java
@@ -21,10 +21,14 @@
/**
* A holder of selected HTTP details related to an OAuth2 authentication request.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class OAuth2AuthenticationDetails implements Serializable {
private static final long serialVersionUID = -4809832298438307309L;
@@ -63,19 +67,22 @@ public OAuth2AuthenticationDetails(HttpServletRequest request) {
if (remoteAddress!=null) {
builder.append("remoteAddress=").append(remoteAddress);
}
- if (builder.length()>1) {
- builder.append(", ");
- }
if (sessionId!=null) {
- builder.append("sessionId=");
- if (builder.length()>1) {
+ if (builder.length() > 1) {
builder.append(", ");
}
+ builder.append("sessionId=");
}
if (tokenType!=null) {
+ if (builder.length() > 1) {
+ builder.append(", ");
+ }
builder.append("tokenType=").append(this.tokenType);
}
if (tokenValue!=null) {
+ if (builder.length() > 1) {
+ builder.append(", ");
+ }
builder.append("tokenValue=");
}
this.display = builder.toString();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetailsSource.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetailsSource.java
index 880c374e0..8358c77f3 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetailsSource.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationDetailsSource.java
@@ -20,10 +20,14 @@
/**
* A source for authentication details in an OAuth2 protected Resource.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class OAuth2AuthenticationDetailsSource implements
AuthenticationDetailsSource {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationManager.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationManager.java
index f81470cda..4d94f0598 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationManager.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationManager.java
@@ -31,10 +31,14 @@
/**
* An {@link AuthenticationManager} for OAuth2 protected resources.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class OAuth2AuthenticationManager implements AuthenticationManager, InitializingBean {
private ResourceServerTokenServices tokenServices;
@@ -82,7 +86,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
String token = (String) authentication.getPrincipal();
OAuth2Authentication auth = tokenServices.loadAuthentication(token);
if (auth == null) {
- throw new InvalidTokenException("Invalid token: " + token);
+ throw new InvalidTokenException("Invalid token");
}
Collection resourceIds = auth.getOAuth2Request().getResourceIds();
@@ -119,7 +123,7 @@ private void checkClientDetails(OAuth2Authentication auth) {
for (String scope : auth.getOAuth2Request().getScope()) {
if (!allowed.contains(scope)) {
throw new OAuth2AccessDeniedException(
- "Invalid token contains disallowed scope (" + scope + ") for this client");
+ "Invalid token contains disallowed scope for this client");
}
}
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationProcessingFilter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationProcessingFilter.java
index cc27d8d26..7152691cb 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationProcessingFilter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/OAuth2AuthenticationProcessingFilter.java
@@ -47,10 +47,14 @@
* A pre-authentication filter for OAuth2 protected resources. Extracts an OAuth2 token from the incoming request and
* uses it to populate the Spring Security context with an {@link OAuth2Authentication} (if used in conjunction with an
* {@link OAuth2AuthenticationManager}).
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class OAuth2AuthenticationProcessingFilter implements Filter, InitializingBean {
private final static Log logger = LogFactory.getLog(OAuth2AuthenticationProcessingFilter.class);
@@ -70,7 +74,9 @@ public class OAuth2AuthenticationProcessingFilter implements Filter, Initializin
/**
* Flag to say that this filter guards stateless resources (default true). Set this to true if the only way the
* resource can be accessed is with a token. If false then an incoming cookie can populate the security context and
- * allow access to a caller that isn't an OAuth2 client.
+ * allow access to a caller that isn't an OAuth2 client. When false, remember to also allow sessions to be created
+ * by configuring session management with a session creation policy that allows sessions to be set.
+ * See {@link org.springframework.security.config.http.SessionCreationPolicy} for your choices.
*
* @param stateless the flag to set (default true)
*/
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/TokenExtractor.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/TokenExtractor.java
index d0864e6c4..2537b1eb2 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/TokenExtractor.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/authentication/TokenExtractor.java
@@ -18,9 +18,13 @@
import org.springframework.security.core.Authentication;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public interface TokenExtractor {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/BaseClientDetails.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/BaseClientDetails.java
index 0dccf8230..e1a82439e 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/BaseClientDetails.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/BaseClientDetails.java
@@ -19,64 +19,52 @@
/**
* Base implementation of
* {@link org.springframework.security.oauth2.provider.ClientDetails}.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
@SuppressWarnings("serial")
-@org.codehaus.jackson.map.annotate.JsonSerialize(include = org.codehaus.jackson.map.annotate.JsonSerialize.Inclusion.NON_DEFAULT)
-@org.codehaus.jackson.annotate.JsonIgnoreProperties(ignoreUnknown = true)
@com.fasterxml.jackson.annotation.JsonInclude(com.fasterxml.jackson.annotation.JsonInclude.Include.NON_DEFAULT)
@com.fasterxml.jackson.annotation.JsonIgnoreProperties(ignoreUnknown = true)
+@Deprecated
public class BaseClientDetails implements ClientDetails {
- @org.codehaus.jackson.annotate.JsonProperty("client_id")
@com.fasterxml.jackson.annotation.JsonProperty("client_id")
private String clientId;
- @org.codehaus.jackson.annotate.JsonProperty("client_secret")
@com.fasterxml.jackson.annotation.JsonProperty("client_secret")
private String clientSecret;
- @org.codehaus.jackson.map.annotate.JsonDeserialize(using = JacksonArrayOrStringDeserializer.class)
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = Jackson2ArrayOrStringDeserializer.class)
private Set scope = Collections.emptySet();
- @org.codehaus.jackson.annotate.JsonProperty("resource_ids")
- @org.codehaus.jackson.map.annotate.JsonDeserialize(using = JacksonArrayOrStringDeserializer.class)
@com.fasterxml.jackson.annotation.JsonProperty("resource_ids")
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = Jackson2ArrayOrStringDeserializer.class)
private Set resourceIds = Collections.emptySet();
- @org.codehaus.jackson.annotate.JsonProperty("authorized_grant_types")
- @org.codehaus.jackson.map.annotate.JsonDeserialize(using = JacksonArrayOrStringDeserializer.class)
@com.fasterxml.jackson.annotation.JsonProperty("authorized_grant_types")
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = Jackson2ArrayOrStringDeserializer.class)
private Set authorizedGrantTypes = Collections.emptySet();
- @org.codehaus.jackson.annotate.JsonProperty("redirect_uri")
- @org.codehaus.jackson.map.annotate.JsonDeserialize(using = JacksonArrayOrStringDeserializer.class)
@com.fasterxml.jackson.annotation.JsonProperty("redirect_uri")
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = Jackson2ArrayOrStringDeserializer.class)
private Set registeredRedirectUris;
- @org.codehaus.jackson.annotate.JsonProperty("autoapprove")
- @org.codehaus.jackson.map.annotate.JsonDeserialize(using = JacksonArrayOrStringDeserializer.class)
@com.fasterxml.jackson.annotation.JsonProperty("autoapprove")
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = Jackson2ArrayOrStringDeserializer.class)
private Set autoApproveScopes;
private List authorities = Collections.emptyList();
- @org.codehaus.jackson.annotate.JsonProperty("access_token_validity")
@com.fasterxml.jackson.annotation.JsonProperty("access_token_validity")
private Integer accessTokenValiditySeconds;
- @org.codehaus.jackson.annotate.JsonProperty("refresh_token_validity")
@com.fasterxml.jackson.annotation.JsonProperty("refresh_token_validity")
private Integer refreshTokenValiditySeconds;
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
private Map additionalInformation = new LinkedHashMap();
@@ -142,7 +130,6 @@ public BaseClientDetails(String clientId, String resourceIds,
}
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public String getClientId() {
return clientId;
@@ -169,19 +156,16 @@ public boolean isAutoApprove(String scope) {
return false;
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public Set getAutoApproveScopes() {
return autoApproveScopes;
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public boolean isSecretRequired() {
return this.clientSecret != null;
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public String getClientSecret() {
return clientSecret;
@@ -191,7 +175,6 @@ public void setClientSecret(String clientSecret) {
this.clientSecret = clientSecret;
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public boolean isScoped() {
return this.scope != null && !this.scope.isEmpty();
@@ -206,7 +189,6 @@ public void setScope(Collection scope) {
: new LinkedHashSet(scope);
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public Set getResourceIds() {
return resourceIds;
@@ -217,7 +199,6 @@ public void setResourceIds(Collection resourceIds) {
. emptySet() : new LinkedHashSet(resourceIds);
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public Set getAuthorizedGrantTypes() {
return authorizedGrantTypes;
@@ -228,7 +209,6 @@ public void setAuthorizedGrantTypes(Collection authorizedGrantTypes) {
authorizedGrantTypes);
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public Set getRegisteredRedirectUri() {
return registeredRedirectUris;
@@ -239,15 +219,12 @@ public void setRegisteredRedirectUri(Set registeredRedirectUris) {
: new LinkedHashSet(registeredRedirectUris);
}
- @org.codehaus.jackson.annotate.JsonProperty("authorities")
@com.fasterxml.jackson.annotation.JsonProperty("authorities")
private List getAuthoritiesAsStrings() {
return new ArrayList(
AuthorityUtils.authorityListToSet(authorities));
}
- @org.codehaus.jackson.annotate.JsonProperty("authorities")
- @org.codehaus.jackson.map.annotate.JsonDeserialize(using = JacksonArrayOrStringDeserializer.class)
@com.fasterxml.jackson.annotation.JsonProperty("authorities")
@com.fasterxml.jackson.databind.annotation.JsonDeserialize(using = Jackson2ArrayOrStringDeserializer.class)
private void setAuthoritiesAsStrings(Set values) {
@@ -255,20 +232,17 @@ private void setAuthoritiesAsStrings(Set values) {
.toArray(new String[values.size()])));
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public Collection getAuthorities() {
return authorities;
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public void setAuthorities(
Collection authorities) {
this.authorities = new ArrayList(authorities);
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public Integer getAccessTokenValiditySeconds() {
return accessTokenValiditySeconds;
@@ -278,7 +252,6 @@ public void setAccessTokenValiditySeconds(Integer accessTokenValiditySeconds) {
this.accessTokenValiditySeconds = accessTokenValiditySeconds;
}
- @org.codehaus.jackson.annotate.JsonIgnore
@com.fasterxml.jackson.annotation.JsonIgnore
public Integer getRefreshTokenValiditySeconds() {
return refreshTokenValiditySeconds;
@@ -294,13 +267,11 @@ public void setAdditionalInformation(Map additionalInformation) {
additionalInformation);
}
- @org.codehaus.jackson.annotate.JsonAnyGetter
@com.fasterxml.jackson.annotation.JsonAnyGetter
public Map getAdditionalInformation() {
return Collections.unmodifiableMap(this.additionalInformation);
}
- @org.codehaus.jackson.annotate.JsonAnySetter
@com.fasterxml.jackson.annotation.JsonAnySetter
public void addAdditionalInformation(String key, Object value) {
this.additionalInformation.put(key, value);
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenEndpointFilter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenEndpointFilter.java
index 22d3d57b9..f4fb58f33 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenEndpointFilter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenEndpointFilter.java
@@ -38,10 +38,14 @@
* parameters if included as a security filter, as permitted by the specification (but not recommended). It is
* recommended by the specification that you permit HTTP basic authentication for clients, and not use this filter at
* all.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ClientCredentialsTokenEndpointFilter extends AbstractAuthenticationProcessingFilter {
private AuthenticationEntryPoint authenticationEntryPoint = new OAuth2AuthenticationEntryPoint();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenGranter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenGranter.java
index 2ddfff51d..e56d1593a 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenGranter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientCredentialsTokenGranter.java
@@ -25,9 +25,13 @@
import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ClientCredentialsTokenGranter extends AbstractTokenGranter {
private static final String GRANT_TYPE = "client_credentials";
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientDetailsUserDetailsService.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientDetailsUserDetailsService.java
index ed49f6845..bcc6c9967 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientDetailsUserDetailsService.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/ClientDetailsUserDetailsService.java
@@ -22,9 +22,13 @@
import org.springframework.security.oauth2.provider.NoSuchClientException;
/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class ClientDetailsUserDetailsService implements UserDetailsService {
private final ClientDetailsService clientDetailsService;
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/InMemoryClientDetailsService.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/InMemoryClientDetailsService.java
index bc519b5bb..1ce56e397 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/InMemoryClientDetailsService.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/InMemoryClientDetailsService.java
@@ -27,8 +27,12 @@
/**
* Basic, in-memory implementation of the client details service.
*
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public class InMemoryClientDetailsService implements ClientDetailsService {
private Map clientDetailsStore = new HashMap();
@@ -36,7 +40,7 @@ public class InMemoryClientDetailsService implements ClientDetailsService {
public ClientDetails loadClientByClientId(String clientId) throws ClientRegistrationException {
ClientDetails details = clientDetailsStore.get(clientId);
if (details == null) {
- throw new NoSuchClientException("No client with requested id: " + clientId);
+ throw new NoSuchClientException("No client with requested id");
}
return details;
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/Jackson2ArrayOrStringDeserializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/Jackson2ArrayOrStringDeserializer.java
index 20698f491..4e6285c9b 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/Jackson2ArrayOrStringDeserializer.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/Jackson2ArrayOrStringDeserializer.java
@@ -16,7 +16,13 @@
import com.fasterxml.jackson.databind.deser.std.StdDeserializer;
import com.fasterxml.jackson.databind.type.SimpleType;
+/**
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ */
@SuppressWarnings("serial")
+@Deprecated
public class Jackson2ArrayOrStringDeserializer extends StdDeserializer> {
public Jackson2ArrayOrStringDeserializer() {
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/JacksonArrayOrStringDeserializer.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/JacksonArrayOrStringDeserializer.java
deleted file mode 100644
index 18677562a..000000000
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/JacksonArrayOrStringDeserializer.java
+++ /dev/null
@@ -1,41 +0,0 @@
-package org.springframework.security.oauth2.provider.client;
-
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.LinkedHashSet;
-import java.util.Set;
-
-import org.codehaus.jackson.JsonParser;
-import org.codehaus.jackson.JsonProcessingException;
-import org.codehaus.jackson.JsonToken;
-import org.codehaus.jackson.map.DeserializationContext;
-import org.codehaus.jackson.map.deser.std.StdDeserializer;
-import org.codehaus.jackson.map.type.SimpleType;
-import org.codehaus.jackson.type.JavaType;
-import org.codehaus.jackson.type.TypeReference;
-import org.springframework.util.StringUtils;
-
-public class JacksonArrayOrStringDeserializer extends StdDeserializer> {
-
- public JacksonArrayOrStringDeserializer() {
- super(Set.class);
- }
-
- @Override
- public JavaType getValueType() {
- return SimpleType.construct(String.class);
- }
-
- @Override
- public Set deserialize(JsonParser jp, DeserializationContext ctxt) throws IOException,
- JsonProcessingException {
- JsonToken token = jp.getCurrentToken();
- if (token.isScalarValue()) {
- String list = jp.getText();
- list = list.replaceAll("\\s+", ",");
- return new LinkedHashSet(Arrays.asList(StringUtils.commaDelimitedListToStringArray(list)));
- }
- return jp.readValueAs(new TypeReference>() {
- });
- }
-}
\ No newline at end of file
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/JdbcClientDetailsService.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/JdbcClientDetailsService.java
index d4a4ef465..1c9439abb 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/JdbcClientDetailsService.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/client/JdbcClientDetailsService.java
@@ -23,11 +23,12 @@
import java.util.List;
import java.util.Map;
import java.util.Set;
-
import javax.sql.DataSource;
+import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
+
import org.springframework.dao.DuplicateKeyException;
import org.springframework.dao.EmptyResultDataAccessException;
import org.springframework.jdbc.core.JdbcTemplate;
@@ -49,7 +50,12 @@
/**
* Basic, JDBC implementation of the client details service.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
*/
+@Deprecated
public class JdbcClientDetailsService implements ClientDetailsService, ClientRegistrationService {
private static final Log logger = LogFactory.getLog(JdbcClientDetailsService.class);
@@ -119,7 +125,7 @@ public ClientDetails loadClientByClientId(String clientId) throws InvalidClientE
details = jdbcTemplate.queryForObject(selectClientDetailsSql, new ClientDetailsRowMapper(), clientId);
}
catch (EmptyResultDataAccessException e) {
- throw new NoSuchClientException("No client with requested id: " + clientId);
+ throw new NoSuchClientException("No client with requested id");
}
return details;
@@ -130,28 +136,28 @@ public void addClientDetails(ClientDetails clientDetails) throws ClientAlreadyEx
jdbcTemplate.update(insertClientDetailsSql, getFields(clientDetails));
}
catch (DuplicateKeyException e) {
- throw new ClientAlreadyExistsException("Client already exists: " + clientDetails.getClientId(), e);
+ throw new ClientAlreadyExistsException("Client already exists", e);
}
}
public void updateClientDetails(ClientDetails clientDetails) throws NoSuchClientException {
int count = jdbcTemplate.update(updateClientDetailsSql, getFieldsForUpdate(clientDetails));
if (count != 1) {
- throw new NoSuchClientException("No client found with id = " + clientDetails.getClientId());
+ throw new NoSuchClientException("No client found with requested id");
}
}
public void updateClientSecret(String clientId, String secret) throws NoSuchClientException {
int count = jdbcTemplate.update(updateClientSecretSql, passwordEncoder.encode(secret), clientId);
if (count != 1) {
- throw new NoSuchClientException("No client found with id = " + clientId);
+ throw new NoSuchClientException("No client found with requested id");
}
}
public void removeClientDetails(String clientId) throws NoSuchClientException {
int count = jdbcTemplate.update(deleteClientDetailsSql, clientId);
if (count != 1) {
- throw new NoSuchClientException("No client found with id = " + clientId);
+ throw new NoSuchClientException("No client found with requested id");
}
}
@@ -287,29 +293,12 @@ interface JsonMapper {
}
private static JsonMapper createJsonMapper() {
- if (ClassUtils.isPresent("org.codehaus.jackson.map.ObjectMapper", null)) {
- return new JacksonMapper();
- }
- else if (ClassUtils.isPresent("com.fasterxml.jackson.databind.ObjectMapper", null)) {
+ if (ClassUtils.isPresent("com.fasterxml.jackson.databind.ObjectMapper", null)) {
return new Jackson2Mapper();
}
return new NotSupportedJsonMapper();
}
- private static class JacksonMapper implements JsonMapper {
- private org.codehaus.jackson.map.ObjectMapper mapper = new org.codehaus.jackson.map.ObjectMapper();
-
- @Override
- public String write(Object input) throws Exception {
- return mapper.writeValueAsString(input);
- }
-
- @Override
- public T read(String input, Class type) throws Exception {
- return mapper.readValue(input, type);
- }
- }
-
private static class Jackson2Mapper implements JsonMapper {
private com.fasterxml.jackson.databind.ObjectMapper mapper = new com.fasterxml.jackson.databind.ObjectMapper();
@@ -328,13 +317,13 @@ private static class NotSupportedJsonMapper implements JsonMapper {
@Override
public String write(Object input) throws Exception {
throw new UnsupportedOperationException(
- "Neither Jackson 1 nor 2 is available so JSON conversion cannot be done");
+ "Jackson 2 is not available so JSON conversion cannot be done");
}
@Override
public T read(String input, Class type) throws Exception {
throw new UnsupportedOperationException(
- "Neither Jackson 1 nor 2 is available so JSON conversion cannot be done");
+ "Jackson 2 is not available so JSON conversion cannot be done");
}
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeServices.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeServices.java
index 3c6ee338a..809823649 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeServices.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeServices.java
@@ -5,9 +5,13 @@
/**
* Services for issuing and storing authorization codes.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
*/
+@Deprecated
public interface AuthorizationCodeServices {
/**
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeTokenGranter.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeTokenGranter.java
index c7be47b54..968e677c8 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeTokenGranter.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/AuthorizationCodeTokenGranter.java
@@ -36,10 +36,14 @@
/**
* Token granter for the authorization code grant type.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Dave Syer
*
*/
+@Deprecated
public class AuthorizationCodeTokenGranter extends AbstractTokenGranter {
private static final String GRANT_TYPE = "authorization_code";
@@ -70,7 +74,7 @@ protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, Tok
OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
if (storedAuth == null) {
- throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
+ throw new InvalidGrantException("Invalid authorization code");
}
OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/InMemoryAuthorizationCodeServices.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/InMemoryAuthorizationCodeServices.java
index d75dfa108..47e0d03be 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/InMemoryAuthorizationCodeServices.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/InMemoryAuthorizationCodeServices.java
@@ -6,10 +6,14 @@
/**
* Implementation of authorization code services that stores the codes and authentication in memory.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public class InMemoryAuthorizationCodeServices extends RandomValueAuthorizationCodeServices {
protected final ConcurrentHashMap authorizationCodeStore = new ConcurrentHashMap();
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/JdbcAuthorizationCodeServices.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/JdbcAuthorizationCodeServices.java
index a02fef029..e7c90d42e 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/JdbcAuthorizationCodeServices.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/JdbcAuthorizationCodeServices.java
@@ -16,10 +16,14 @@
/**
* Implementation of authorization code services that stores the codes and authentication in a database.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ken Dombeck
* @author Dave Syer
*/
+@Deprecated
public class JdbcAuthorizationCodeServices extends RandomValueAuthorizationCodeServices {
private static final String DEFAULT_SELECT_STATEMENT = "select code, authentication from oauth_code where code = ?";
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/RandomValueAuthorizationCodeServices.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/RandomValueAuthorizationCodeServices.java
index be091bab0..154d12987 100644
--- a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/RandomValueAuthorizationCodeServices.java
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/RandomValueAuthorizationCodeServices.java
@@ -6,10 +6,14 @@
/**
* Base implementation for authorization code services that generates a random-value authorization code.
- *
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
* @author Ryan Heaton
* @author Dave Syer
*/
+@Deprecated
public abstract class RandomValueAuthorizationCodeServices implements AuthorizationCodeServices {
private RandomValueStringGenerator generator = new RandomValueStringGenerator();
@@ -28,7 +32,7 @@ public OAuth2Authentication consumeAuthorizationCode(String code)
throws InvalidGrantException {
OAuth2Authentication auth = this.remove(code);
if (auth == null) {
- throw new InvalidGrantException("Invalid authorization code: " + code);
+ throw new InvalidGrantException("Invalid authorization code");
}
return auth;
}
diff --git a/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/RedisAuthorizationCodeServices.java b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/RedisAuthorizationCodeServices.java
new file mode 100644
index 000000000..083bc72ca
--- /dev/null
+++ b/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/provider/code/RedisAuthorizationCodeServices.java
@@ -0,0 +1,143 @@
+/*
+ * Copyright 2002-2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.oauth2.provider.code;
+
+import java.lang.reflect.Method;
+import java.util.List;
+
+import org.springframework.data.redis.connection.RedisConnection;
+import org.springframework.data.redis.connection.RedisConnectionFactory;
+import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.security.oauth2.provider.token.store.redis.JdkSerializationStrategy;
+import org.springframework.security.oauth2.provider.token.store.redis.RedisTokenStoreSerializationStrategy;
+import org.springframework.util.ClassUtils;
+import org.springframework.util.ReflectionUtils;
+
+/**
+ * Implementation of authorization code services that stores the codes and authentication in Redis.
+ *
+ *
+ * @deprecated See the OAuth 2.0 Migration Guide for Spring Security 5.
+ *
+ * @author Stefan Rempfer
+ */
+@Deprecated
+public class RedisAuthorizationCodeServices extends RandomValueAuthorizationCodeServices {
+
+ private static final boolean springDataRedis_2_0 = ClassUtils.isPresent(
+ "org.springframework.data.redis.connection.RedisStandaloneConfiguration",
+ RedisAuthorizationCodeServices.class.getClassLoader());
+
+ private static final String AUTH_CODE = "auth_code:";
+
+ private final RedisConnectionFactory connectionFactory;
+
+ private String prefix = "";
+
+ private RedisTokenStoreSerializationStrategy serializationStrategy = new JdkSerializationStrategy();
+
+ private Method redisConnectionSet_2_0;
+
+ /**
+ * Default constructor.
+ *
+ * @param connectionFactory the connection factory which should be used to obtain a connection to Redis
+ */
+ public RedisAuthorizationCodeServices(RedisConnectionFactory connectionFactory) {
+ this.connectionFactory = connectionFactory;
+ if (springDataRedis_2_0) {
+ this.loadRedisConnectionMethods_2_0();
+ }
+ }
+
+ @Override
+ protected void store(String code, OAuth2Authentication authentication) {
+ byte[] key = serializeKey(AUTH_CODE + code);
+ byte[] auth = serialize(authentication);
+
+ RedisConnection conn = getConnection();
+ try {
+ if (springDataRedis_2_0) {
+ try {
+ this.redisConnectionSet_2_0.invoke(conn, key, auth);
+ } catch (Exception ex) {
+ throw new RuntimeException(ex);
+ }
+ } else {
+ conn.set(key, auth);
+ }
+ }
+ finally {
+ conn.close();
+ }
+ }
+
+ @Override
+ protected OAuth2Authentication remove(String code) {
+ byte[] key = serializeKey(AUTH_CODE + code);
+
+ List