Support custom validation in OidcLogoutAuthenticationProvider #1723
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
jgrandja
added
type: enhancement
There was a problem hiding this comment.
Thanks for the PR @Kehrlann !
In addition to addressing the feedback, please add documentation to the reference similar to Customizing Authorization Request Validation and Customizing Client Credentials Grant Request Validation.
| @@ -0,0 +1,142 @@ | |||
| /* | |||
| * Copyright 2020-2023 the original author or authors. | |||
| @@ -21,6 +21,7 @@ | |||
| import java.security.Principal; | |||
| import java.util.Base64; | |||
| @@ -0,0 +1,94 @@ | |||
| /* | |||
| * Copyright 2020-2023 the original author or authors. | |||
| * Returns the {@link OAuth2Authorization authorization request}. | ||
| * @return the {@link OAuth2Authorization} | ||
| */ | ||
| public OAuth2Authorization getAuthorizationRequest() { |
There was a problem hiding this comment.
This is not used so can be removed
There was a problem hiding this comment.
I think we should leave it.
Since this is the OidcLogoutAuthenticationContext, it goes beyond just the logout URI. The OAuth2Authorization is part of the the logout context and is loaded from a repository, it may prove useful for users who want to perform further checks.
| /** | ||
| * The default validator for {@link OidcIdToken#getAudience()}. | ||
| */ | ||
| public static final Consumer<OidcLogoutAuthenticationContext> DEFAULT_AUDIENCE_VALIDATOR = OidcLogoutAuthenticationValidator::validateAudience; |
There was a problem hiding this comment.
I think we should reset this change since this issue is to address post_logout_redirect_uri customization. Is this needed here?
There was a problem hiding this comment.
I wanted to give more a bit flexibility in logout validation, and showcase how validators can be composed, similar to what we do in the redirect uri validation.
Happy to remove it though - In I can't think of a valid use-case where the id_token doesn't have the client_id in the aud claim.
- Similar to custom validation in OAuth2AuthorizationCodeRequestAuthenticationProvider - Closes spring-projectsgh-1693
Kehrlann
force-pushed
the
customize-post-logout-redirect-uri-check
branch
from
bbd9476
to
ef54d36
Compare
OAuth2AuthorizationCodeRequestAuthenticationProviderpost_logout_redirect_urivalidation in OIDC RP-initiated logout #1693