Skip to content

CXF-9222 - Remove partialMatchScopeValidation for OAuth #3254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
coheigea merged 1 commit into from
Jun 26, 2026
+28 −66
Merged

CXF-9222 - Remove partialMatchScopeValidation for OAuth #3254

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions ...t/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/AbstractGrantHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,8 +144,7 @@ protected ServerAccessToken getPreAuthorizedToken(Client client,
String requestedGrant,
List<String> requestedScopes,
List<String> audiences) {
if (!OAuthUtils.validateScopes(requestedScopes, client.getRegisteredScopes(),
partialMatchScopeValidation)) {
if (!OAuthUtils.validateScopes(requestedScopes, client.getRegisteredScopes())) {
throw new OAuthServiceException(new OAuthError(OAuthConstants.INVALID_SCOPE));
}
if (!OAuthUtils.validateAudiences(audiences, client.getRegisteredAudiences())) {
Expand Down
7 changes: 1 addition & 6 deletions .../main/java/org/apache/cxf/rs/security/oauth2/grants/refresh/RefreshTokenGrantHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@
public class RefreshTokenGrantHandler implements AccessTokenGrantHandler {

private OAuthDataProvider dataProvider;
private boolean partialMatchScopeValidation;
private boolean useAllClientScopes;

public void setDataProvider(OAuthDataProvider dataProvider) {
Expand All @@ -50,16 +49,12 @@ public ServerAccessToken createAccessToken(Client client, MultivaluedMap<String,
List<String> requestedScopes = OAuthUtils.getRequestedScopes(client,
params.getFirst(OAuthConstants.SCOPE),
useAllClientScopes,
partialMatchScopeValidation, false);
false);
final ServerAccessToken st = dataProvider.refreshAccessToken(client, refreshToken, requestedScopes);
st.setGrantType(OAuthConstants.REFRESH_TOKEN_GRANT);
return st;
}

public void setPartialMatchScopeValidation(boolean partialMatchScopeValidation) {
this.partialMatchScopeValidation = partialMatchScopeValidation;
}

public void setUseAllClientScopes(boolean useAllClientScopes) {
this.useAllClientScopes = useAllClientScopes;
}
Expand Down
11 changes: 2 additions & 9 deletions ...rc/main/java/org/apache/cxf/rs/security/oauth2/services/RedirectionBasedGrantService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,6 @@ public abstract class RedirectionBasedGrantService extends AbstractOAuthService
private Set<String> supportedResponseTypes;
private String supportedGrantType;
private boolean useAllClientScopes;
private boolean partialMatchScopeValidation;
private boolean useRegisteredRedirectUriIfPossible = true;
private SessionAuthenticityTokenProvider sessionAuthenticityTokenProvider;
private SubjectCreator subjectCreator;
Expand Down Expand Up @@ -180,8 +179,7 @@ protected Response startAuthorization(MultivaluedMap<String, String> params,
try {
requestedScope = OAuthUtils.getRequestedScopes(client,
providedScope,
useAllClientScopes,
partialMatchScopeValidation);
useAllClientScopes);
requestedPermissions = getDataProvider().convertScopeToPermissions(client, requestedScope);
} catch (OAuthServiceException ex) {
LOG.log(Level.FINE, "Error processing scopes", ex);
Expand Down Expand Up @@ -401,8 +399,7 @@ protected Response completeAuthorization(MultivaluedMap<String, String> params)
approvedScope.add(rScope);
}
}
if (!OAuthUtils.validateScopes(requestedScope, client.getRegisteredScopes(),
partialMatchScopeValidation)) {
if (!OAuthUtils.validateScopes(requestedScope, client.getRegisteredScopes())) {
return createErrorResponse(params, redirectUri, OAuthConstants.INVALID_SCOPE);
}
getMessageContext().put(AUTHORIZATION_REQUEST_PARAMETERS, params);
Expand Down Expand Up @@ -571,10 +568,6 @@ public void setResourceOwnerNameProvider(ResourceOwnerNameProvider resourceOwner
this.resourceOwnerNameProvider = resourceOwnerNameProvider;
}

public void setPartialMatchScopeValidation(boolean partialMatchScopeValidation) {
this.partialMatchScopeValidation = partialMatchScopeValidation;
}

public void setUseAllClientScopes(boolean useAllClientScopes) {
this.useAllClientScopes = useAllClientScopes;
}
Expand Down
30 changes: 6 additions & 24 deletions ...oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,15 +321,13 @@ public static boolean checkRequestURI(String servletPath, String uri) {

public static List<String> getRequestedScopes(Client client,
String scopeParameter,
boolean useAllClientScopes,
boolean partialMatchScopeValidation) {
return getRequestedScopes(client, scopeParameter, useAllClientScopes, partialMatchScopeValidation, true);
boolean useAllClientScopes) {
return getRequestedScopes(client, scopeParameter, useAllClientScopes, true);
}

public static List<String> getRequestedScopes(Client client,
String scopeParameter,
boolean useAllClientScopes,
boolean partialMatchScopeValidation,
boolean defaultToRegisteredScopes) {
List<String> requestScopes = parseScope(scopeParameter);
List<String> registeredScopes = client.getRegisteredScopes();
Expand All @@ -339,7 +337,7 @@ public static List<String> getRequestedScopes(Client client,
}
return requestScopes;
}
if (!validateScopes(requestScopes, registeredScopes, partialMatchScopeValidation)) {
if (!validateScopes(requestScopes, registeredScopes)) {
throw new OAuthServiceException("Unexpected scope");
}
if (useAllClientScopes) {
Expand All @@ -353,26 +351,10 @@ public static List<String> getRequestedScopes(Client client,
return requestScopes;
}

public static boolean validateScopes(List<String> requestScopes, List<String> registeredScopes,
boolean partialMatchScopeValidation) {
public static boolean validateScopes(List<String> requestScopes, List<String> registeredScopes) {
if (!registeredScopes.isEmpty()) {
// if it is a strict validation then pre-registered scopes have to contains all
// the current request scopes
if (!partialMatchScopeValidation) {
return registeredScopes.containsAll(requestScopes);
}
for (String requestScope : requestScopes) {
boolean match = false;
for (String registeredScope : registeredScopes) {
if (requestScope.startsWith(registeredScope)) {
match = true;
break;
}
}
if (!match) {
return false;
}
}
// pre-registered scopes have to contains all the current request scopes
return registeredScopes.containsAll(requestScopes);
}
return true;
}
Expand Down
43 changes: 18 additions & 25 deletions ...h-parent/oauth2/src/test/java/org/apache/cxf/rs/security/oauth2/utils/OAuthUtilsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,8 @@
*/
package org.apache.cxf.rs.security.oauth2.utils;

import java.util.Collections;
import java.util.List;

import org.apache.cxf.rs.security.oauth2.common.Client;

import org.junit.Test;

import static org.junit.Assert.assertEquals;
Expand All @@ -35,42 +32,38 @@ public class OAuthUtilsTest {
public void testValidateScopesStrict() {
List<String> requestScopes = OAuthUtils.parseScope("a c b");
List<String> registeredScopes = OAuthUtils.parseScope("a b c d");
assertTrue(OAuthUtils.validateScopes(requestScopes, registeredScopes, false));
assertTrue(OAuthUtils.validateScopes(requestScopes, registeredScopes));
}
@Test
public void testValidateScopesStrictFail() {
List<String> requestScopes = OAuthUtils.parseScope("a b c d");
List<String> registeredScopes = OAuthUtils.parseScope("a b d");
assertFalse(OAuthUtils.validateScopes(requestScopes, registeredScopes, false));
}

@Test
public void testValidateScopesPartial() {
List<String> requestScopes = OAuthUtils.parseScope("a b c-1");
List<String> registeredScopes = OAuthUtils.parseScope("a b c");
assertTrue(OAuthUtils.validateScopes(requestScopes, registeredScopes, true));
assertFalse(OAuthUtils.validateScopes(requestScopes, registeredScopes));
}

@Test
public void testValidateScopesPartialFail() {
List<String> requestScopes = OAuthUtils.parseScope("a b c");
List<String> registeredScopes = OAuthUtils.parseScope("a b");
assertFalse(OAuthUtils.validateScopes(requestScopes, registeredScopes, true));
public void testParseScopeEmpty() {
assertTrue(OAuthUtils.parseScope(null).isEmpty());
assertTrue(OAuthUtils.parseScope("").isEmpty());
assertTrue(OAuthUtils.parseScope(" ").isEmpty());
}

@Test
public void testGetRequestedScopesRegistered() {
Client c = new Client();
List<String> scopes = Collections.singletonList("a");
c.setRegisteredScopes(scopes);
assertEquals(scopes, OAuthUtils.getRequestedScopes(c, "", false, false));
public void testParseScopeWithExtraSpaces() {
List<String> scopes = OAuthUtils.parseScope(" read write admin ");
assertEquals(3, scopes.size());
assertEquals("read", scopes.get(0));
assertEquals("write", scopes.get(1));
assertEquals("admin", scopes.get(2));
}

@Test
public void testParseScopeEmpty() {
assertTrue(OAuthUtils.parseScope(null).isEmpty());
assertTrue(OAuthUtils.parseScope("").isEmpty());
assertTrue(OAuthUtils.parseScope(" ").isEmpty());
public void testParseScopeWithDuplicates() {
List<String> scopes = OAuthUtils.parseScope("a a b");
assertEquals(3, scopes.size());
assertEquals("a", scopes.get(0));
assertEquals("a", scopes.get(1));
assertEquals("b", scopes.get(2));
}

}