Examples with OAuth2Error org.springframework.security.oauth2.core.OAuth2Error used on opensource projects

Example 86 with OAuth2Error

use of org.springframework.security.oauth2.core.OAuth2Error in project spring-authorization-server by spring-projects.

the class OAuth2TokenIntrospectionEndpointFilterTests method doFilterWhenTokenIntrospectionRequestInvalidParameterThenError.

private void doFilterWhenTokenIntrospectionRequestInvalidParameterThenError(String parameterName, String errorCode, MockHttpServletRequest request) throws Exception {
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain filterChain = mock(FilterChain.class);
    this.filter.doFilter(request, response, filterChain);
    verifyNoInteractions(filterChain);
    assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
    OAuth2Error error = readError(response);
    assertThat(error.getErrorCode()).isEqualTo(errorCode);
    assertThat(error.getDescription()).isEqualTo("OAuth 2.0 Token Introspection Parameter: " + parameterName);
}

Example 87 with OAuth2Error

use of org.springframework.security.oauth2.core.OAuth2Error in project spring-authorization-server by spring-projects.

the class OidcUserInfoEndpointFilterTests method doFilterWhenUserInfoRequestInvalidTokenThenUnauthorizedError.

@Test
public void doFilterWhenUserInfoRequestInvalidTokenThenUnauthorizedError() throws Exception {
    Authentication principal = new TestingAuthenticationToken("principal", "credentials");
    SecurityContextHolder.getContext().setAuthentication(principal);
    when(this.authenticationManager.authenticate(any())).thenThrow(new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_TOKEN));
    String requestUri = DEFAULT_OIDC_USER_INFO_ENDPOINT_URI;
    MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
    request.setServletPath(requestUri);
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain filterChain = mock(FilterChain.class);
    this.filter.doFilter(request, response, filterChain);
    verifyNoInteractions(filterChain);
    assertThat(response.getStatus()).isEqualTo(HttpStatus.UNAUTHORIZED.value());
    OAuth2Error error = readError(response);
    assertThat(error.getErrorCode()).isEqualTo(OAuth2ErrorCodes.INVALID_TOKEN);
}

Example 88 with OAuth2Error

use of org.springframework.security.oauth2.core.OAuth2Error in project spring-authorization-server by spring-projects.

the class OidcClientRegistrationEndpointFilterTests method doFilterWhenClientConfigurationRequestMultipleClientIdThenInvalidRequestError.

@Test
public void doFilterWhenClientConfigurationRequestMultipleClientIdThenInvalidRequestError() throws Exception {
    String requestUri = DEFAULT_OIDC_CLIENT_REGISTRATION_ENDPOINT_URI;
    MockHttpServletRequest request = new MockHttpServletRequest("GET", requestUri);
    request.setServletPath(requestUri);
    request.addParameter(OAuth2ParameterNames.CLIENT_ID, "client-id");
    request.addParameter(OAuth2ParameterNames.CLIENT_ID, "client-id2");
    MockHttpServletResponse response = new MockHttpServletResponse();
    FilterChain filterChain = mock(FilterChain.class);
    this.filter.doFilter(request, response, filterChain);
    verifyNoInteractions(filterChain);
    assertThat(response.getStatus()).isEqualTo(HttpStatus.BAD_REQUEST.value());
    OAuth2Error error = readError(response);
    assertThat(error.getErrorCode()).isEqualTo(OAuth2ErrorCodes.INVALID_REQUEST);
}

Example 89 with OAuth2Error

use of org.springframework.security.oauth2.core.OAuth2Error in project spring-authorization-server by spring-projects.

the class OAuth2ClientAuthenticationFilter method onAuthenticationFailure.

private void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException {
    SecurityContextHolder.clearContext();
    // TODO
    // The authorization server MAY return an HTTP 401 (Unauthorized) status code
    // to indicate which HTTP authentication schemes are supported.
    // If the client attempted to authenticate via the "Authorization" request header field,
    // the authorization server MUST respond with an HTTP 401 (Unauthorized) status code and
    // include the "WWW-Authenticate" response header field
    // matching the authentication scheme used by the client.
    OAuth2Error error = ((OAuth2AuthenticationException) exception).getError();
    ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
    if (OAuth2ErrorCodes.INVALID_CLIENT.equals(error.getErrorCode())) {
        httpResponse.setStatusCode(HttpStatus.UNAUTHORIZED);
    } else {
        httpResponse.setStatusCode(HttpStatus.BAD_REQUEST);
    }
    // We don't want to reveal too much information to the caller so just return the error code
    OAuth2Error errorResponse = new OAuth2Error(error.getErrorCode());
    this.errorHttpResponseConverter.write(errorResponse, null, httpResponse);
}

Example 90 with OAuth2Error

use of org.springframework.security.oauth2.core.OAuth2Error in project spring-authorization-server by spring-projects.

the class OAuth2TokenRevocationEndpointFilter method sendErrorResponse.

private void sendErrorResponse(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException {
    OAuth2Error error = ((OAuth2AuthenticationException) exception).getError();
    ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
    httpResponse.setStatusCode(HttpStatus.BAD_REQUEST);
    this.errorHttpResponseConverter.write(error, null, httpResponse);
}