Allow Token Introspection to be customized

[gourav]

Closes gh-493

[gourav]

Hi @jgrandja
It is ready for your review.

This is my first time contributing. Please let me know the changes required. I will do them right away.

[jgrandja]

Apologies @gourav, as I have led you down the wrong path with my comment:

We need the capability to customize the default claims initialized by withActiveTokenClaims().

Take a look at OidcUserInfoAuthenticationProvider.setUserInfoMapper() for inspiration, as the implementation might be similar. For example, we could create a new class OAuth2TokenIntrospectionAuthenticationContext that provides a getter for accessing OAuth2TokenIntrospection.Builder, allowing to customize the claims before build() is called.

There are 2 changes that are required.

1. The OAuth2TokenIntrospectionAuthenticationProvider.withActiveTokenClaims() initializes the standard claims as defined in the spec, however, it does not include any other claims that may be available in authorizedToken.getClaims(). For example, if an application configured an OAuth2TokenCustomizer, which added custom claims to the Jwt claim set then this would not be included in OAuth2TokenIntrospection. So we need to update this method to include ALL claims available authorizedToken.getClaims(), e.g. OAuth2TokenIntrospection.withClaims(authorizedToken.getClaims())

2. We need to add the customization hooks, which will be very similar to the hooks that were recently added for Token Revocation in Allow Token Revocation to be customized #476. Take a look at the commits a846e93 and 4d5b288 and apply the similar changes.

[gourav]

Hi @jgrandja. I am pretty sure that I did not understand your comment properly. So, no apologies required. :)
Let me get it updated as per the suggestion.

[gourav]

Hi @jgrandja
What would these hooks be configuring ?
As per your suggestion, I can simply add OAuth2TokenIntrospection.withClaims(authorizedToken.getClaims()) to add all claims available in authorizedToken.getClaims().

What would the hook be customising as I believe all configuration is already present in the context ?
Or is it for customising Function<OAuth2TokenIntrospectionAuthenticationContext, OAuth2TokenIntrospection> activeClaimsMapper that will be introduced by current state of this pull request ?

[jgrandja]

@gourav

Or is it for customising Function<OAuth2TokenIntrospectionAuthenticationContext, OAuth2TokenIntrospection> activeClaimsMapper that will be introduced by current state of this pull request

Please ignore my comment regarding activeClaimsMapper as this is not needed.

What would these hooks be configuring ?

There are use cases where an application needs to customize the request and/or response for a specific protocol flow. For example, an application may want to add a custom parameter in the access token response. How would they do that? They would supply a custom OAuth2TokenEndpointFilter.setAuthenticationSuccessHandler() to customize the response using OAuth2AccessTokenResponseHttpMessageConverter.

The same applies for the token request. For example, a custom parameter may be needed and therefore the application can supply OAuth2TokenEndpointFilter.setAuthenticationConverter() to read the custom parameter so it's carried through to the AuthenticationProvider.

We need the same customization capabilities for token introspection. For example, an application may not want to return all the claims in OAuth2TokenIntrospection.withClaims(authorizedToken.getClaims()) and possibly filter out one or more claims via OAuth2TokenIntrospectionEndpointFilter.setAuthenticationSuccessHandler() using OAuth2TokenIntrospectionHttpMessageConverter to customize the response.

Please review the code for OAuth2TokenEndpointConfigurer and OAuth2TokenRevocationEndpointConfigurer and see how all the components work together and ultimately allow for complete customization of request and response.

[gourav]

Hi @jgrandja
This is ready for your review. :)

[jgrandja]

Apologies for the delay @gourav. I've been quite busy with some priority tasks for the 0.2.3 release.

I came back to this yesterday and there were quite a few changes still needed before we can merge.
I'd like to include this in the 0.2.3 release so I went ahead and applied a polish commit.

Please review all the changes and let me know if you have any questions. Thanks.

[gourav]

Changes seem good to me. :)
Please let me know if there is any other issue I can take on.