{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/246","labels_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/246/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/246/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/246/events","html_url":"https://github.com/spring-projects/spring-security-oauth/pull/246","id":40938306,"number":246,"title":"OAuth 1 provider refactoring from filters to end points (a-la OAuth2)","user":{"login":"autayeu","id":495207,"avatar_url":"https://avatars.githubusercontent.com/u/495207?v=3","gravatar_id":"","url":"https://api.github.com/users/autayeu","html_url":"https://github.com/autayeu","followers_url":"https://api.github.com/users/autayeu/followers","following_url":"https://api.github.com/users/autayeu/following{/other_user}","gists_url":"https://api.github.com/users/autayeu/gists{/gist_id}","starred_url":"https://api.github.com/users/autayeu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/autayeu/subscriptions","organizations_url":"https://api.github.com/users/autayeu/orgs","repos_url":"https://api.github.com/users/autayeu/repos","events_url":"https://api.github.com/users/autayeu/events{/privacy}","received_events_url":"https://api.github.com/users/autayeu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2014-08-22T18:47:09Z","updated_at":"2015-06-13T05:42:23Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/pulls/246","html_url":"https://github.com/spring-projects/spring-security-oauth/pull/246","diff_url":"https://github.com/spring-projects/spring-security-oauth/pull/246.diff","patch_url":"https://github.com/spring-projects/spring-security-oauth/pull/246.patch"},"body":"Github-226: https://github.com/spring-projects/spring-security-oauth/issues/226\r\n\r\n# OAuth refactoring notes\r\n\r\n## Migration for users with namespace configuration.\r\n* Check security of OAuth end point URLs (most likely in applicationContext.xml, <http\\intercept-url> elements). See sparklr/applicationContext.xml example.\r\n    * request and access token endpoints need to be accessible to the consumer (they handle requests from the consumer (server), most likely authenticated only by OAuth signature)\r\n    * access confirmation and authorization end points need to be restricted to authorized users, most likely ROLE_USER or similar. They handle requests from the user (browser) and authenticated by standard Spring Security mechanism.\r\n\r\n## Migration for users with manual bean configuration.\r\n* Replace old filters with one OAuthProviderProcessingFilter (usually after ExceptionTranslationFilter) - it should process protected resources and at least request token and access token end point URLs.\r\n* Check that FrameworkEndpointHandlerMapping registers end points URLs and they are properly and not overly protected by the interceptors (see above).\r\n* Use FrameworkEndpointHandlerMapping.setMappings to customize end point URLs. See OAuthConstants.java for default URLs. Example:\r\n\r\n```xml\r\n    <bean id=\"frameworkEndpointHandlerMapping\" class=\"org.springframework.security.oauth.provider.endpoint.FrameworkEndpointHandlerMapping\">\r\n        <property name=\"mappings\">\r\n            <util:map>\r\n                <entry key=\"/oauth_request_token\" value=\"/oauth/request_token\"/>\r\n                <entry key=\"/oauth_access_token\" value=\"/oauth/access_token\"/>\r\n                <entry key=\"/oauth_authenticate_token\" value=\"/oauth/authorize_token\"/>\r\n            </util:map>\r\n        </property>\r\n    </bean>\r\n```\r\n\r\n* Wire beans to OAuthProviderProcessingFilter (e.g. tokenServices, consumerDetailsService, authHandler, frameworkEndpointHandlerMapping). Wire beans to end points: tokenServices for all; rememberMeServices, applicationEventPublisher, verifierServices, authenticationSuccessHandler, authenticationFailureHandler for AuthorizationEndpoint; if needed, configure require10a where present.\r\n\r\n## Localization messages key changes\r\n\r\nMessages have changed. The changed, removed and added keys follow (old = new):\r\n\r\n\r\n    AccessTokenProcessingFilter.missingToken = AccessTokenEndpoint.missingToken\r\n    AccessTokenProcessingFilter.missingVerifier = AccessTokenEndpoint.missingVerifier\r\n    AccessTokenProcessingFilter.missingVerifier =  AccessTokenEndpoint.invalidVerifier\r\n    AccessTokenProcessingFilter.timestampNotNew = removed\r\n    \r\n    OAuthProcessingFilter.missingConsumerKey = OAuthProviderProcessingFilter.missingConsumerKey\r\n    OAuthProcessingFilter.missingCredentials = OAuthProviderProcessingFilter.missingCredentials\r\n    OAuthProcessingFilter.incorrectRealm = OAuthProviderProcessingFilter.incorrectRealm\r\n    OAuthProcessingFilter.missingSignatureMethod = OAuthProviderProcessingFilter.missingSignatureMethod\r\n    OAuthProcessingFilter.missingSignature = OAuthProviderProcessingFilter.missingSignature\r\n    OAuthProcessingFilter.missingTimestamp = OAuthProviderProcessingFilter.missingTimestamp\r\n    OAuthProcessingFilter.missingNonce = OAuthProviderProcessingFilter.missingNonce\r\n    OAuthProcessingFilter.invalidTimestamp = OAuthProviderProcessingFilter.invalidTimestamp\r\n    OAuthProcessingFilter.timestampNotNew = removed\r\n    \r\n    ProtectedResourceProcessingFilter.missingToken = OAuthProviderProcessingFilter.missingToken\r\n    \r\n    AccessTokenProcessingFilter.missingCallback = RequestTokenEndpoint.missingCallback\r\n    new = RequestTokenEndpoint.missingCredentials\r\n\r\n\r\n## Summary of changes for OAuth developers\r\n\r\n### Architecture\r\nUpgraded provider architecture: one filter (OAuthProviderProcessingFilter) and several end points (AbstractEndpoint subclasses, standard Spring MVC request mappings). OAuthProviderProcessingFilter processes signatures and loads authentication for framework end points and for protected resource requests.\r\n\r\n### Code\r\n* OAuthParameter.java - merged consumer and provider parameters, because they were used interchangeably.\r\n* OAuthParameters.java - container for OAuth requests. POJO is faster than map.\r\n* StringSplitUtils.java - refactored to use List instead of array to reduce memory allocations.\r\n* OAuthProviderBeanDefinitionParser.java - upgraded to configure the refactored framework.\r\n* CoreOAuthConsumerSupport.java - refactoring collateral.\r\n* OAuthConsumerContextFilter.java - refactoring collateral.\r\n* AbstractEndpoint.java - base class for framework end points.\r\n* AccessTokenEndpoint.java - access token end point.\r\n* AuthorizationEndpoint.java - token authorization end point.\r\n* FrameworkEndpoint.java - annotation to mark framework end points. Includes a parameter to differ the ones not requiring OAuth signature.\r\n* FrameworkEndpointHandlerMapping.java - handler mapping which sets up the end points.\r\n* RequestTokenEndpoint.java - request token end point.\r\n* UserAuthorizationSuccessfulAuthenticationHandler.java - moved.\r\n* CoreOAuthProviderSupport.java - refactoring collateral.\r\n* OAuthProviderProcessingFilter.java - core filter. Now a OncePerRequestFilter, processes OAuth signatures and loads consumer and user authentication when possible. Changes:\r\n    * removed allowedMethods. Now controlled by endpoints.\r\n    * removed filterProcessesUrl. Now protects both end points and resources.\r\n    * changed SecurityContext processing. Now a new context is established before OAuth processing and the whole context is saved-restored, not just Authentication.\r\n* ConsumerAuthentication.java - refactoring collateral.\r\n* OAuthProviderSupport.java - refactoring collateral.\r\n\r\nThere is a new dependency on spring-webmvc.\r\n\r\n### Tests\r\n* AuthorizationServerBeanDefinitionParserTests.java - refactoring collateral damage.\r\n* CoreOAuthConsumerSupportTests.java - refactoring collateral damage.\r\n* OAuthConsumerContextFilterTests.java - refactoring collateral damage.\r\n* AccessTokenEndpointTests.java - increased code coverage.\r\n* AuthorizationEndpointTests.java - increased code coverage.\r\n* RequestTokenEndpointTests.java - increased code coverage.\r\n* UserAuthorizationSuccessfulAuthenticationHandlerTests.java - refactoring collateral damage.\r\n* OAuthProviderProcessingFilterTests.java - increased code coverage.\r\n* CoreOAuthProviderSupportTests.java - increased code coverage.\r\n\r\nDebug output is enabled in tests to increase code coverage and test debug clauses (construction of messages, etc)."},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/comments/111674933","html_url":"https://github.com/spring-projects/spring-security-oauth/pull/246#issuecomment-111674933","issue_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/246","id":111674933,"user":{"login":"dsyer","id":124075,"avatar_url":"https://avatars.githubusercontent.com/u/124075?v=3","gravatar_id":"","url":"https://api.github.com/users/dsyer","html_url":"https://github.com/dsyer","followers_url":"https://api.github.com/users/dsyer/followers","following_url":"https://api.github.com/users/dsyer/following{/other_user}","gists_url":"https://api.github.com/users/dsyer/gists{/gist_id}","starred_url":"https://api.github.com/users/dsyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsyer/subscriptions","organizations_url":"https://api.github.com/users/dsyer/orgs","repos_url":"https://api.github.com/users/dsyer/repos","events_url":"https://api.github.com/users/dsyer/events{/privacy}","received_events_url":"https://api.github.com/users/dsyer/received_events","type":"User","site_admin":false},"created_at":"2015-06-13T05:42:22Z","updated_at":"2015-06-13T05:42:22Z","body":"Thanks for the reminder. The only thing that stops work on 2.1 is really the amount of stuff still happening in 2.0. If you want to speed things up you could pick up issues and send pull requests for 2.0.8, but since most of the open issues are about OAuth2 you might not be interested in doing that."}}