Skip to content

Commit c5aa6d9

Browse files
yybmionyybmion
committed
Allow injecting the principal name into DefaultOAuth2User
- Add username field to DefaultOAuth2User - Deprecate constructor that uses nameAttributeKey lookup - Add static factory method withUsername() for direct username injection - Update Jackson mixin to maintain backward compatibility - Preserve serialization format by excluding username field This change prepares for SpEL support in the next commit. Signed-off-by: yybmion <[email protected]>
1 parent 455a2ec commit c5aa6d9

File tree

6 files changed

+147
-10
lines changed

6 files changed

+147
-10
lines changed

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/jackson2/DefaultOAuth2UserMixin.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -32,6 +32,7 @@
3232
* This mixin class is used to serialize/deserialize {@link DefaultOAuth2User}.
3333
*
3434
* @author Joe Grandja
35+
* @author YooBin Yoon
3536
* @since 5.3
3637
* @see DefaultOAuth2User
3738
* @see OAuth2ClientJackson2Module
@@ -45,7 +46,7 @@ abstract class DefaultOAuth2UserMixin {
4546
@JsonCreator
4647
DefaultOAuth2UserMixin(@JsonProperty("authorities") Collection<? extends GrantedAuthority> authorities,
4748
@JsonProperty("attributes") Map<String, Object> attributes,
48-
@JsonProperty("nameAttributeKey") String nameAttributeKey) {
49+
@JsonProperty("nameAttributeKey") String nameAttributeKey, @JsonProperty("username") String username) {
4950
}
5051

5152
}

‎oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/jackson2/DefaultOidcUserMixin.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
4141
@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
4242
isGetterVisibility = JsonAutoDetect.Visibility.NONE)
43-
@JsonIgnoreProperties(value = { "attributes" }, ignoreUnknown = true)
43+
@JsonIgnoreProperties(value = { "attributes", "username" }, ignoreUnknown = true)
4444
abstract class DefaultOidcUserMixin {
4545

4646
@JsonCreator

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/jackson2/OAuth2AuthenticationTokenMixinTests.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -194,7 +194,8 @@ private static String asJson(DefaultOAuth2User oauth2User) {
194194
" \"@class\": \"java.util.Collections$UnmodifiableMap\",\n" +
195195
" \"username\": \"user\"\n" +
196196
" },\n" +
197-
" \"nameAttributeKey\": \"username\"\n" +
197+
" \"nameAttributeKey\": \"username\",\n" +
198+
" \"username\": \"" + oauth2User.getName() + "\"\n" +
198199
" }";
199200
// @formatter:on
200201
}

‎oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/jackson2/OAuth2AuthorizedClientMixinTests.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2021 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -145,6 +145,8 @@ public void deserializeWhenMixinRegisteredThenDeserializes() throws Exception {
145145
.isEqualTo(expectedClientRegistration.getProviderDetails().getUserInfoEndpoint().getAuthenticationMethod());
146146
assertThat(clientRegistration.getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName()).isEqualTo(
147147
expectedClientRegistration.getProviderDetails().getUserInfoEndpoint().getUserNameAttributeName());
148+
assertThat(clientRegistration.getProviderDetails().getUserInfoEndpoint().getUsernameExpression())
149+
.isEqualTo(expectedClientRegistration.getProviderDetails().getUserInfoEndpoint().getUsernameExpression());
148150
assertThat(clientRegistration.getProviderDetails().getJwkSetUri())
149151
.isEqualTo(expectedClientRegistration.getProviderDetails().getJwkSetUri());
150152
assertThat(clientRegistration.getProviderDetails().getIssuerUri())
@@ -306,6 +308,10 @@ private static String asJson(ClientRegistration clientRegistration) {
306308
.map((key) -> "\"" + key + "\": \"" + providerDetails.getConfigurationMetadata().get(key) + "\"")
307309
.collect(Collectors.joining(","));
308310
}
311+
312+
String usernameExpression = (userInfoEndpoint.getUsernameExpression() != null)
313+
? "\"" + userInfoEndpoint.getUsernameExpression() + "\"" : null;
314+
309315
// @formatter:off
310316
return "{\n" +
311317
" \"@class\": \"org.springframework.security.oauth2.client.registration.ClientRegistration\",\n" +
@@ -333,7 +339,8 @@ private static String asJson(ClientRegistration clientRegistration) {
333339
" \"authenticationMethod\": {\n" +
334340
" \"value\": \"" + userInfoEndpoint.getAuthenticationMethod().getValue() + "\"\n" +
335341
" },\n" +
336-
" \"userNameAttributeName\": " + ((userInfoEndpoint.getUserNameAttributeName() != null) ? "\"" + userInfoEndpoint.getUserNameAttributeName() + "\"" : null) + "\n" +
342+
" \"userNameAttributeName\": " + ((userInfoEndpoint.getUserNameAttributeName() != null) ? "\"" + userInfoEndpoint.getUserNameAttributeName() + "\"" : null) + ",\n" +
343+
" \"usernameExpression\": " + usernameExpression + "\n" +
337344
" },\n" +
338345
" \"jwkSetUri\": " + ((providerDetails.getJwkSetUri() != null) ? "\"" + providerDetails.getJwkSetUri() + "\"" : null) + ",\n" +
339346
" \"issuerUri\": " + ((providerDetails.getIssuerUri() != null) ? "\"" + providerDetails.getIssuerUri() + "\"" : null) + ",\n" +

‎oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/user/DefaultOAuth2User.java‎

Lines changed: 43 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -45,6 +45,7 @@
4545
* @author Joe Grandja
4646
* @author Eddú Meléndez
4747
* @author Park Hyojong
48+
* @author YooBin Yoon
4849
* @since 5.0
4950
* @see OAuth2User
5051
*/
@@ -58,13 +59,17 @@ public class DefaultOAuth2User implements OAuth2User, Serializable {
5859

5960
private final String nameAttributeKey;
6061

62+
private final String username;
63+
6164
/**
6265
* Constructs a {@code DefaultOAuth2User} using the provided parameters.
6366
* @param authorities the authorities granted to the user
6467
* @param attributes the attributes about the user
6568
* @param nameAttributeKey the key used to access the user's &quot;name&quot; from
6669
* {@link #getAttributes()}
70+
* @deprecated Use {@link #withUsername(Collection, Map, String)} instead
6771
*/
72+
@Deprecated
6873
public DefaultOAuth2User(Collection<? extends GrantedAuthority> authorities, Map<String, Object> attributes,
6974
String nameAttributeKey) {
7075
Assert.notEmpty(attributes, "attributes cannot be empty");
@@ -77,11 +82,47 @@ public DefaultOAuth2User(Collection<? extends GrantedAuthority> authorities, Map
7782
: Collections.unmodifiableSet(new LinkedHashSet<>(AuthorityUtils.NO_AUTHORITIES));
7883
this.attributes = Collections.unmodifiableMap(new LinkedHashMap<>(attributes));
7984
this.nameAttributeKey = nameAttributeKey;
85+
this.username = attributes.get(nameAttributeKey).toString();
86+
}
87+
88+
/**
89+
* Constructs a {@code DefaultOAuth2User} using the provided parameters. This
90+
* constructor is used by Jackson for deserialization.
91+
* @param authorities the authorities granted to the user
92+
* @param attributes the attributes about the user
93+
* @param nameAttributeKey the key used to access the user's &quot;name&quot; from
94+
* {@link #getAttributes()} - preserved for backwards compatibility
95+
* @param username the user's name
96+
*/
97+
private DefaultOAuth2User(Collection<? extends GrantedAuthority> authorities, Map<String, Object> attributes,
98+
String nameAttributeKey, String username) {
99+
Assert.notEmpty(attributes, "attributes cannot be empty");
100+
101+
this.authorities = (authorities != null)
102+
? Collections.unmodifiableSet(new LinkedHashSet<>(this.sortAuthorities(authorities)))
103+
: Collections.unmodifiableSet(new LinkedHashSet<>(AuthorityUtils.NO_AUTHORITIES));
104+
this.attributes = Collections.unmodifiableMap(new LinkedHashMap<>(attributes));
105+
this.nameAttributeKey = nameAttributeKey;
106+
this.username = (username != null) ? username : attributes.get(nameAttributeKey).toString();
107+
108+
Assert.hasText(this.username, "username cannot be empty");
109+
}
110+
111+
/**
112+
* Creates a new {@code DefaultOAuth2User} with the username injected directly.
113+
* @param authorities the authorities granted to the user
114+
* @param attributes the attributes about the user
115+
* @param username the user's name
116+
* @return a new {@code DefaultOAuth2User}
117+
*/
118+
public static DefaultOAuth2User withUsername(Collection<? extends GrantedAuthority> authorities,
119+
Map<String, Object> attributes, String username) {
120+
return new DefaultOAuth2User(authorities, attributes, null, username);
80121
}
81122

82123
@Override
83124
public String getName() {
84-
return this.getAttribute(this.nameAttributeKey).toString();
125+
return this.username;
85126
}
86127

87128
@Override

‎oauth2/oauth2-core/src/test/java/org/springframework/security/oauth2/core/user/DefaultOAuth2UserTests.java‎

Lines changed: 88 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
1717
package org.springframework.security.oauth2.core.user;
1818

1919
import java.util.Collections;
20+
import java.util.HashMap;
2021
import java.util.Map;
2122
import java.util.Set;
2223

@@ -35,6 +36,7 @@
3536
* @author Vedran Pavic
3637
* @author Joe Grandja
3738
* @author Park Hyojong
39+
* @author Yoobin Yoon
3840
*/
3941
public class DefaultOAuth2UserTests {
4042

@@ -109,4 +111,89 @@ public void constructorWhenCreatedThenIsSerializable() {
109111
SerializationUtils.serialize(user);
110112
}
111113

114+
@Test
115+
public void withUsernameWhenValidParametersThenCreated() {
116+
String directUsername = "directUser";
117+
DefaultOAuth2User user = DefaultOAuth2User.withUsername(AUTHORITIES, ATTRIBUTES, directUsername);
118+
119+
assertThat(user.getName()).isEqualTo(directUsername);
120+
assertThat(user.getAuthorities()).hasSize(1);
121+
assertThat(user.getAuthorities().iterator().next()).isEqualTo(AUTHORITY);
122+
assertThat(user.getAttributes()).containsOnlyKeys(ATTRIBUTE_NAME_KEY);
123+
assertThat(user.getAttributes().get(ATTRIBUTE_NAME_KEY)).isEqualTo(USERNAME);
124+
}
125+
126+
@Test
127+
public void withUsernameWhenUsernameIsEmptyThenThrowIllegalArgumentException() {
128+
assertThatIllegalArgumentException()
129+
.isThrownBy(() -> DefaultOAuth2User.withUsername(AUTHORITIES, ATTRIBUTES, ""));
130+
}
131+
132+
@Test
133+
public void withUsernameWhenAttributesIsNullThenThrowIllegalArgumentException() {
134+
assertThatIllegalArgumentException()
135+
.isThrownBy(() -> DefaultOAuth2User.withUsername(AUTHORITIES, null, "username"));
136+
}
137+
138+
@Test
139+
public void withUsernameWhenAttributesIsEmptyThenThrowIllegalArgumentException() {
140+
assertThatIllegalArgumentException()
141+
.isThrownBy(() -> DefaultOAuth2User.withUsername(AUTHORITIES, Collections.emptyMap(), "username"));
142+
}
143+
144+
@Test
145+
public void withUsernameWhenCreatedThenIsSerializable() {
146+
DefaultOAuth2User user = DefaultOAuth2User.withUsername(AUTHORITIES, ATTRIBUTES, "directUser");
147+
SerializationUtils.serialize(user);
148+
}
149+
150+
@Test
151+
public void withUsernameWhenUsernameProvidedThenTakesPrecedenceOverAttributes() {
152+
Map<String, Object> attributes = new HashMap<>();
153+
attributes.put("username", "fromAttributes");
154+
attributes.put("id", "123");
155+
156+
DefaultOAuth2User user = DefaultOAuth2User.withUsername(AUTHORITIES, attributes, "directUsername");
157+
158+
assertThat(user.getName()).isEqualTo("directUsername");
159+
assertThat((String) user.getAttribute("username")).isEqualTo("fromAttributes");
160+
}
161+
162+
@Test
163+
public void constructorWhenSimpleAttributeKeyThenWorksAsUsual() {
164+
DefaultOAuth2User user = new DefaultOAuth2User(AUTHORITIES, ATTRIBUTES, ATTRIBUTE_NAME_KEY);
165+
166+
assertThat(user.getName()).isEqualTo(USERNAME);
167+
assertThat(user.getAttributes()).containsOnlyKeys(ATTRIBUTE_NAME_KEY);
168+
}
169+
170+
@Test
171+
public void withUsernameAndDeprecatedConstructorWhenSameDataThenEqual() {
172+
DefaultOAuth2User user1 = new DefaultOAuth2User(AUTHORITIES, ATTRIBUTES, ATTRIBUTE_NAME_KEY);
173+
DefaultOAuth2User user2 = DefaultOAuth2User.withUsername(AUTHORITIES, ATTRIBUTES, USERNAME);
174+
175+
assertThat(user1.getName()).isEqualTo(user2.getName());
176+
assertThat(user1.getAuthorities()).isEqualTo(user2.getAuthorities());
177+
assertThat(user1.getAttributes()).isEqualTo(user2.getAttributes());
178+
assertThat(user1).isEqualTo(user2);
179+
}
180+
181+
@Test
182+
public void withUsernameWhenAuthoritiesIsNullThenCreatedWithEmptyAuthorities() {
183+
DefaultOAuth2User user = DefaultOAuth2User.withUsername(null, ATTRIBUTES, "testUser");
184+
185+
assertThat(user.getName()).isEqualTo("testUser");
186+
assertThat(user.getAuthorities()).isEmpty();
187+
assertThat(user.getAttributes()).isEqualTo(ATTRIBUTES);
188+
}
189+
190+
@Test
191+
public void withUsernameWhenAuthoritiesIsEmptyThenCreated() {
192+
DefaultOAuth2User user = DefaultOAuth2User.withUsername(Collections.emptySet(), ATTRIBUTES, "testUser");
193+
194+
assertThat(user.getName()).isEqualTo("testUser");
195+
assertThat(user.getAuthorities()).isEmpty();
196+
assertThat(user.getAttributes()).isEqualTo(ATTRIBUTES);
197+
}
198+
112199
}

0 commit comments

Comments
 (0)