Skip to content

Commit 980d753

Browse files
martin-lindstromjgrandja
martin-lindstrom
authored and
jgrandja
committed
Fix to save all values for multi-valued device grant parameters
Fixes gh-1269
1 parent b39771d commit 980d753

10 files changed

+21
-14
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceAuthorizationConsentAuthenticationConverter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ public Authentication convert(HttpServletRequest request) {
110110
!key.equals(OAuth2ParameterNames.USER_CODE) &&
111111
!key.equals(OAuth2ParameterNames.STATE) &&
112112
!key.equals(OAuth2ParameterNames.SCOPE)) {
113-
additionalParameters.put(key, value.get(0));
113+
additionalParameters.put(key, value.size() == 1 ? value.get(0) : value.toArray(new String[0]));
114114
}
115115
});
116116

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceAuthorizationRequestAuthenticationConverter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ public Authentication convert(HttpServletRequest request) {
7575
parameters.forEach((key, value) -> {
7676
if (!key.equals(OAuth2ParameterNames.CLIENT_ID) &&
7777
!key.equals(OAuth2ParameterNames.SCOPE)) {
78-
additionalParameters.put(key, value.get(0));
78+
additionalParameters.put(key, value.size() == 1 ? value.get(0) : value.toArray(new String[0]));
7979
}
8080
});
8181

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceCodeAuthenticationConverter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ public Authentication convert(HttpServletRequest request) {
7474
if (!key.equals(OAuth2ParameterNames.GRANT_TYPE) &&
7575
!key.equals(OAuth2ParameterNames.CLIENT_ID) &&
7676
!key.equals(OAuth2ParameterNames.DEVICE_CODE)) {
77-
additionalParameters.put(key, value.get(0));
77+
additionalParameters.put(key, value.size() == 1 ? value.get(0) : value.toArray(new String[0]));
7878
}
7979
});
8080

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceVerificationAuthenticationConverter.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ public Authentication convert(HttpServletRequest request) {
8080
Map<String, Object> additionalParameters = new HashMap<>();
8181
parameters.forEach((key, value) -> {
8282
if (!key.equals(OAuth2ParameterNames.USER_CODE)) {
83-
additionalParameters.put(key, value.get(0));
83+
additionalParameters.put(key, value.size() == 1 ? value.get(0) : value.toArray(new String[0]));
8484
}
8585
});
8686

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2DeviceAuthorizationEndpointFilterTests.java

+3-1
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ public void doFilterWhenDeviceAuthorizationRequestThenDeviceAuthorizationRespons
195195

196196
MockHttpServletRequest request = createRequest();
197197
request.addParameter("custom-param-1", "custom-value-1");
198+
request.addParameter("custom-param-2", "custom-value-2a", "custom-value-2b");
198199
MockHttpServletResponse response = new MockHttpServletResponse();
199200
FilterChain filterChain = mock(FilterChain.class);
200201
this.filter.doFilter(request, response, filterChain);
@@ -211,7 +212,8 @@ public void doFilterWhenDeviceAuthorizationRequestThenDeviceAuthorizationRespons
211212
assertThat(deviceAuthorizationRequestAuthentication.getPrincipal()).isEqualTo(clientPrincipal);
212213
assertThat(deviceAuthorizationRequestAuthentication.getScopes()).isEmpty();
213214
assertThat(deviceAuthorizationRequestAuthentication.getAdditionalParameters())
214-
.containsExactly(entry("custom-param-1", "custom-value-1"));
215+
.containsExactly(entry("custom-param-1", "custom-value-1"),
216+
entry("custom-param-2", new String[] { "custom-value-2a", "custom-value-2b" }));
215217
// @formatter:off
216218
assertThat(deviceAuthorizationRequestAuthentication.getDetails())
217219
.asInstanceOf(type(WebAuthenticationDetails.class))

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/OAuth2DeviceVerificationEndpointFilterTests.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,7 @@ public void doFilterWhenDeviceAuthorizationConsentRequestThenSuccess() throws Ex
187187
request.addParameter(OAuth2ParameterNames.STATE, STATE);
188188
request.addParameter(OAuth2ParameterNames.USER_CODE, USER_CODE);
189189
request.addParameter("custom-param-1", "custom-value-1");
190+
request.addParameter("custom-param-2", "custom-value-2a", "custom-value-2b");
190191
MockHttpServletResponse response = new MockHttpServletResponse();
191192
FilterChain filterChain = mock(FilterChain.class);
192193
this.filter.doFilter(request, response, filterChain);
@@ -207,7 +208,7 @@ public void doFilterWhenDeviceAuthorizationConsentRequestThenSuccess() throws Ex
207208
assertThat(deviceAuthorizationConsentAuthentication.getUserCode()).isEqualTo(USER_CODE);
208209
assertThat(deviceAuthorizationConsentAuthentication.getScopes()).containsExactly("scope-1", "scope-2");
209210
assertThat(deviceAuthorizationConsentAuthentication.getAdditionalParameters())
210-
.containsExactly(entry("custom-param-1", "custom-value-1"));
211+
.containsExactly(entry("custom-param-1", "custom-value-1"), entry("custom-param-2", new String[]{ "custom-value-2a", "custom-value-2b" }));
211212
}
212213

213214
@Test

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceAuthorizationConsentAuthenticationConverterTests.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,7 @@ public void convertWhenAllParametersThenReturnDeviceAuthorizationConsentAuthenti
246246
request.addParameter(OAuth2ParameterNames.SCOPE, "message.read");
247247
request.addParameter(OAuth2ParameterNames.SCOPE, "message.write");
248248
request.addParameter("param-1", "value-1");
249-
request.addParameter("param-2", "value-2");
249+
request.addParameter("param-2", "value-2", "value-2b");
250250

251251
SecurityContextImpl securityContext = new SecurityContextImpl();
252252
securityContext.setAuthentication(new TestingAuthenticationToken("user", null));
@@ -261,7 +261,8 @@ public void convertWhenAllParametersThenReturnDeviceAuthorizationConsentAuthenti
261261
assertThat(authentication.getUserCode()).isEqualTo(USER_CODE);
262262
assertThat(authentication.getScopes()).containsExactly("message.read", "message.write");
263263
assertThat(authentication.getAdditionalParameters())
264-
.containsExactly(entry("param-1", "value-1"), entry("param-2", "value-2"));
264+
.containsExactly(entry("param-1", "value-1"),
265+
entry("param-2", new String[]{"value-2", "value-2b"}));
265266
}
266267

267268
@Test

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceAuthorizationRequestAuthenticationConverterTests.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ public void convertWhenAllParametersThenReturnDeviceAuthorizationRequestAuthenti
9595
request.addParameter(OAuth2ParameterNames.CLIENT_ID, CLIENT_ID);
9696
request.addParameter(OAuth2ParameterNames.SCOPE, "message.read message.write");
9797
request.addParameter("param-1", "value-1");
98-
request.addParameter("param-2", "value-2");
98+
request.addParameter("param-2", "value-2", "value-2b");
9999

100100
SecurityContextImpl securityContext = new SecurityContextImpl();
101101
securityContext.setAuthentication(new TestingAuthenticationToken(CLIENT_ID, null));
@@ -108,7 +108,8 @@ public void convertWhenAllParametersThenReturnDeviceAuthorizationRequestAuthenti
108108
assertThat(authentication.getAuthorizationUri()).endsWith(AUTHORIZATION_URI);
109109
assertThat(authentication.getScopes()).containsExactly("message.read", "message.write");
110110
assertThat(authentication.getAdditionalParameters())
111-
.containsExactly(entry("param-1", "value-1"), entry("param-2", "value-2"));
111+
.containsExactly(entry("param-1", "value-1"),
112+
entry("param-2", new String[]{"value-2", "value-2b"}));
112113
}
113114

114115
private static MockHttpServletRequest createRequest() {

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceCodeAuthenticationConverterTests.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ public void convertWhenAllParametersThenReturnDeviceCodeAuthenticationToken() {
102102
request.addParameter(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.DEVICE_CODE.getValue());
103103
request.addParameter(OAuth2ParameterNames.DEVICE_CODE, DEVICE_CODE);
104104
request.addParameter("param-1", "value-1");
105-
request.addParameter("param-2", "value-2");
105+
request.addParameter("param-2", "value-2", "value-2b");
106106

107107
SecurityContextImpl securityContext = new SecurityContextImpl();
108108
securityContext.setAuthentication(new TestingAuthenticationToken(CLIENT_ID, null));
@@ -114,7 +114,8 @@ public void convertWhenAllParametersThenReturnDeviceCodeAuthenticationToken() {
114114
assertThat(authentication.getDeviceCode()).isEqualTo(DEVICE_CODE);
115115
assertThat(authentication.getPrincipal()).isInstanceOf(TestingAuthenticationToken.class);
116116
assertThat(authentication.getAdditionalParameters())
117-
.containsExactly(entry("param-1", "value-1"), entry("param-2", "value-2"));
117+
.containsExactly(entry("param-1", "value-1"),
118+
entry("param-2", new String[]{"value-2", "value-2b"}));
118119
}
119120

120121
private static MockHttpServletRequest createRequest() {

‎oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2DeviceVerificationAuthenticationConverterTests.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ public void convertWhenAllParametersThenReturnDeviceVerificationAuthentication()
144144
MockHttpServletRequest request = createRequest();
145145
request.addParameter(OAuth2ParameterNames.USER_CODE, USER_CODE);
146146
request.addParameter("param-1", "value-1");
147-
request.addParameter("param-2", "value-2");
147+
request.addParameter("param-2", "value-2", "value-2b");
148148

149149
SecurityContextImpl securityContext = new SecurityContextImpl();
150150
securityContext.setAuthentication(new TestingAuthenticationToken("user", null));
@@ -156,7 +156,8 @@ public void convertWhenAllParametersThenReturnDeviceVerificationAuthentication()
156156
assertThat(authentication.getPrincipal()).isInstanceOf(TestingAuthenticationToken.class);
157157
assertThat(authentication.getUserCode()).isEqualTo(USER_CODE);
158158
assertThat(authentication.getAdditionalParameters())
159-
.containsExactly(entry("param-1", "value-1"), entry("param-2", "value-2"));
159+
.containsExactly(entry("param-1", "value-1"),
160+
entry("param-2", new String[]{"value-2", "value-2b"}));
160161
}
161162

162163
private static MockHttpServletRequest createRequest() {

0 commit comments

Comments
 (0)