Provide ability to customize HTTP client in ClientRegistrations and JwtDecoders

Closes gh-19014

Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>

Author: evgeniycheban

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java

@@ -47,6 +47,7 @@
  *
  * @author Joe Grandja
  * @author Michael Sosa
+ * @author Evgeniy Cheban
  * @since 5.0
  * @see <a target="_blank" href="https://tools.ietf.org/html/rfc6749#section-2">Section 2
  * Client Registration</a>
@@ -386,6 +387,8 @@ public static final class Builder implements Serializable {
 
 		private @Nullable String issuerUri;
 
+		private @Nullable String trustedIssuer;
+
 		private Map<String, Object> configurationMetadata = Collections.emptyMap();
 
 		private @Nullable String clientName;
@@ -597,6 +600,18 @@ public Builder issuerUri(@Nullable String issuerUri) {
 			return this;
 		}
 
+		/**
+		 * Allows overriding of default issuer validation that requires the requested
+		 * issuer to match the issuer received in the metadata configuration.
+		 * @param trustedIssuer the issuer to use
+		 * @return the {@link Builder}
+		 * @since 7.2
+		 */
+		public Builder trustedIssuer(@Nullable String trustedIssuer) {
+			this.trustedIssuer = trustedIssuer;
+			return this;
+		}
+
 		/**
 		 * Sets the metadata describing the provider's configuration.
 		 * @param configurationMetadata the metadata describing the provider's
@@ -645,6 +660,7 @@ else if (AuthorizationGrantType.AUTHORIZATION_CODE.equals(this.authorizationGran
 			}
 			this.validateAuthorizationGrantTypes();
 			this.validateScopes();
+			this.validateIssuer();
 			return this.create();
 		}
 
@@ -742,6 +758,15 @@ private static boolean withinTheRangeOf(int c, int min, int max) {
 			return c >= min && c <= max;
 		}
 
+		private void validateIssuer() {
+			if (this.issuerUri == null || this.trustedIssuer == null) {
+				return;
+			}
+			Assert.state(this.issuerUri.equals(this.trustedIssuer),
+					() -> "The Issuer \"%s\" provided in the configuration metadata did not match the requested issuer \"%s\""
+						.formatted(this.trustedIssuer, this.issuerUri));
+		}
+
 	}
 
 	/**

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistrations.java

@@ -37,6 +37,7 @@
 import org.springframework.security.oauth2.core.oidc.IdTokenClaimNames;
 import org.springframework.util.Assert;
 import org.springframework.web.client.HttpClientErrorException;
+import org.springframework.web.client.RestOperations;
 import org.springframework.web.client.RestTemplate;
 import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
@@ -148,8 +149,50 @@ public static ClientRegistration.Builder fromOidcConfiguration(Map<String, Objec
 	 * Provider Configuration.
 	 */
 	public static ClientRegistration.Builder fromOidcIssuerLocation(String issuer) {
+		return fromOidcIssuerLocation(issuer, rest);
+	}
+
+	/**
+	 * Creates a {@link ClientRegistration.Builder} using the provided <a href=
+	 * "https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier">Issuer</a>
+	 * by making an <a href=
+	 * "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest">OpenID
+	 * Provider Configuration Request</a> and using the values in the <a href=
+	 * "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse">OpenID
+	 * Provider Configuration Response</a> to initialize the
+	 * {@link ClientRegistration.Builder}.
+	 *
+	 * <p>
+	 * For example, if the issuer provided is "https://example.com", then an "OpenID
+	 * Provider Configuration Request" will be made to
+	 * "https://example.com/.well-known/openid-configuration". The result is expected to
+	 * be an "OpenID Provider Configuration Response".
+	 * </p>
+	 *
+	 * This method uses the provided {@link RestOperations} to query oidc issuer
+	 * configuration.
+	 *
+	 * <p>
+	 * Example usage:
+	 * </p>
+	 * <pre>
+	 * RestTemplate rest = new RestTemplate();
+	 * ClientRegistration registration = ClientRegistrations.fromOidcIssuerLocation("https://example.com", rest)
+	 *     .clientId("client-id")
+	 *     .clientSecret("client-secret")
+	 *     .build();
+	 * </pre>
+	 * @param issuer the <a href=
+	 * "https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier">Issuer</a>
+	 * @param restOperations the {@link RestOperations} to use
+	 * @return a {@link ClientRegistration.Builder} that was initialized by the OpenID
+	 * Provider Configuration.
+	 * @since 7.2
+	 */
+	public static ClientRegistration.Builder fromOidcIssuerLocation(String issuer, RestOperations restOperations) {
 		Assert.hasText(issuer, "issuer cannot be empty");
-		return getBuilder(issuer, oidc(issuer));
+		Assert.notNull(restOperations, "restOperations cannot be null");
+		return getBuilder(issuer, oidc(issuer, restOperations));
 	}
 
 	/**
@@ -191,11 +234,65 @@ public static ClientRegistration.Builder fromOidcIssuerLocation(String issuer) {
 	 * described endpoints
 	 */
 	public static ClientRegistration.Builder fromIssuerLocation(String issuer) {
+		return fromIssuerLocation(issuer, rest);
+	}
+
+	/**
+	 * Creates a {@link ClientRegistration.Builder} using the provided <a href=
+	 * "https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier">Issuer</a>
+	 * by querying three different discovery endpoints serially, using the values in the
+	 * first successful response to initialize. If an endpoint returns anything other than
+	 * a 200 or a 4xx, the method will exit without attempting subsequent endpoints.
+	 *
+	 * <p>
+	 * The three endpoints are computed as follows, given that the {@code issuer} is
+	 * composed of a {@code host} and a {@code path}:
+	 * </p>
+	 *
+	 * <ol>
+	 * <li>{@code host/.well-known/openid-configuration/path}, as defined in
+	 * <a href="https://tools.ietf.org/html/rfc8414#section-5">RFC 8414's Compatibility
+	 * Notes</a>.</li>
+	 * <li>{@code issuer/.well-known/openid-configuration}, as defined in <a href=
+	 * "https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationRequest">
+	 * OpenID Provider Configuration</a>.</li>
+	 * <li>{@code host/.well-known/oauth-authorization-server/path}, as defined in
+	 * <a href="https://tools.ietf.org/html/rfc8414#section-3.1">Authorization Server
+	 * Metadata Request</a>.</li>
+	 * </ol>
+	 *
+	 * Note that the second endpoint is the equivalent of calling
+	 * {@link ClientRegistrations#fromOidcIssuerLocation(String)}.
+	 *
+	 * <p>
+	 * This method uses the provided {@link RestOperations} to query issuer configuration.
+	 * </p>
+	 *
+	 * <p>
+	 * Example usage:
+	 * </p>
+	 * <pre>
+	 * RestTemplate rest = new RestTemplate();
+	 * ClientRegistration registration = ClientRegistrations.fromIssuerLocation("https://example.com", rest)
+	 *     .clientId("client-id")
+	 *     .clientSecret("client-secret")
+	 *     .build();
+	 * </pre>
+	 * @param issuer the <a href=
+	 * "https://openid.net/specs/openid-connect-core-1_0.html#IssuerIdentifier">Issuer</a>
+	 * @param restOperations the {@link RestOperations} to use
+	 * @return a {@link ClientRegistration.Builder} that was initialized by one of the
+	 * described endpoints
+	 * @since 7.2
+	 */
+	public static ClientRegistration.Builder fromIssuerLocation(String issuer, RestOperations restOperations) {
 		Assert.hasText(issuer, "issuer cannot be empty");
-		return getBuilder(issuer, oidc(issuer), oidcRfc8414(issuer), oauth(issuer));
+		Assert.notNull(restOperations, "restOperations cannot be null");
+		return getBuilder(issuer, oidc(issuer, restOperations), oidcRfc8414(issuer, restOperations),
+				oauth(issuer, restOperations));
 	}
 
-	static Supplier<ClientRegistration.Builder> oidc(String issuer) {
+	static Supplier<ClientRegistration.Builder> oidc(String issuer, RestOperations rest) {
 		UriComponents uri = oidcUri(issuer);
 		// @formatter:on
 		return () -> {
@@ -220,10 +317,10 @@ static UriComponents oidcUri(String issuer) {
 				.build();
 	}
 
-	static Supplier<ClientRegistration.Builder> oidcRfc8414(String issuer) {
+	static Supplier<ClientRegistration.Builder> oidcRfc8414(String issuer, RestOperations rest) {
 		UriComponents uri = oidcRfc8414Uri(issuer);
 		// @formatter:on
-		return getRfc8414Builder(issuer, uri);
+		return getRfc8414Builder(issuer, uri, rest);
 	}
 
 	static UriComponents oidcRfc8414Uri(String issuer) {
@@ -234,9 +331,9 @@ static UriComponents oidcRfc8414Uri(String issuer) {
 				.build();
 	}
 
-	static Supplier<ClientRegistration.Builder> oauth(String issuer) {
+	static Supplier<ClientRegistration.Builder> oauth(String issuer, RestOperations rest) {
 		UriComponents uri = oauthUri(issuer);
-		return getRfc8414Builder(issuer, uri);
+		return getRfc8414Builder(issuer, uri, rest);
 	}
 
 	static UriComponents oauthUri(String issuer) {
@@ -248,7 +345,8 @@ static UriComponents oauthUri(String issuer) {
 		// @formatter:on
 	}
 
-	private static Supplier<ClientRegistration.Builder> getRfc8414Builder(String issuer, UriComponents uri) {
+	private static Supplier<ClientRegistration.Builder> getRfc8414Builder(String issuer, UriComponents uri,
+			RestOperations rest) {
 		return () -> {
 			RequestEntity<Void> request = RequestEntity.get(uri.toUriString()).build();
 			Map<String, Object> configuration = rest.exchange(request, typeReference).getBody();
@@ -317,9 +415,6 @@ private static <T> T parse(Map<String, Object> body, ThrowingFunction<JSONObject
 	private static ClientRegistration.Builder withProviderConfiguration(AuthorizationServerMetadata metadata,
 			String issuer) {
 		String metadataIssuer = metadata.getIssuer().getValue();
-		Assert.state(issuer.equals(metadataIssuer),
-				() -> "The Issuer \"" + metadataIssuer + "\" provided in the configuration metadata did "
-						+ "not match the requested issuer \"" + issuer + "\"");
 		String name = URI.create(issuer).getHost();
 		ClientAuthenticationMethod method = getClientAuthenticationMethod(metadata.getTokenEndpointAuthMethods());
 		URI authorizationEndpointURI = metadata.getAuthorizationEndpointURI();
@@ -336,6 +431,7 @@ private static ClientRegistration.Builder withProviderConfiguration(Authorizatio
 				.authorizationUri((authorizationEndpointURI != null) ? authorizationEndpointURI.toASCIIString() : null)
 				.providerConfigurationMetadata(configurationMetadata)
 				.issuerUri(issuer)
+				.trustedIssuer(metadataIssuer)
 				.clientName(issuer);
 		if (tokenEndpointURI != null) {
 			builder.tokenUri(tokenEndpointURI.toASCIIString());

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/registration/ClientRegistrationTests.java

@@ -37,11 +37,13 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
 
 /**
  * Tests for {@link ClientRegistration}.
  *
  * @author Joe Grandja
+ * @author Evgeniy Cheban
  */
 public class ClientRegistrationTests {
 
@@ -731,6 +733,32 @@ void buildWhenInvalidGrantTypeForPkceThenPkceDisabled(AuthorizationGrantType inv
 		assertThat(clientRegistration.getClientSettings().isRequireProofKey()).isFalse();
 	}
 
+	@Test
+	void buildWhenTrustedIssuerNotMatchThenException() {
+		ClientRegistration.Builder builder = ClientRegistration.withRegistrationId(REGISTRATION_ID)
+			.clientId(CLIENT_ID)
+			.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
+			.tokenUri(TOKEN_URI)
+			.issuerUri("https://example.com")
+			.trustedIssuer("https://local.example.com");
+		assertThatIllegalStateException().isThrownBy(builder::build).withMessage("""
+				The Issuer "https://local.example.com" provided in the configuration metadata did \
+				not match the requested issuer "https://example.com"\
+				""");
+	}
+
+	@Test
+	void buildWhenTrustedIssuerMatchesThenBuilds() {
+		ClientRegistration registration = ClientRegistration.withRegistrationId(REGISTRATION_ID)
+			.clientId(CLIENT_ID)
+			.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
+			.tokenUri(TOKEN_URI)
+			.issuerUri("https://example.com")
+			.trustedIssuer("https://example.com")
+			.build();
+		assertThat(registration.getProviderDetails().getIssuerUri()).isEqualTo("https://example.com");
+	}
+
 	static List<AuthorizationGrantType> invalidPkceGrantTypes() {
 		return Arrays.stream(AuthorizationGrantType.class.getFields())
 			.filter((field) -> Modifier.isFinal(field.getModifiers())

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/registration/ClientRegistrationsTests.java

@@ -34,6 +34,7 @@
 import org.springframework.http.MediaType;
 import org.springframework.security.oauth2.core.AuthorizationGrantType;
 import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
+import org.springframework.web.client.RestTemplate;
 import org.springframework.web.util.UriComponents;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -435,7 +436,7 @@ public void issuerWhenOpenIdConfigurationDoesNotMatchThenMeaningfulErrorMessage(
 		this.server.enqueue(mockResponse);
 		// @formatter:off
 		assertThatIllegalStateException()
-				.isThrownBy(() -> ClientRegistrations.fromOidcIssuerLocation(this.issuer))
+				.isThrownBy(() -> ClientRegistrations.fromOidcIssuerLocation(this.issuer).clientId("client-id").build())
 				.withMessageContaining("The Issuer \"https://example.com\" provided in the configuration metadata did "
 						+ "not match the requested issuer \"" + this.issuer + "\"");
 		// @formatter:on
@@ -450,7 +451,7 @@ public void issuerWhenOAuth2ConfigurationDoesNotMatchThenMeaningfulErrorMessage(
 		this.server.enqueue(mockResponse);
 		// @formatter:off
 		assertThatIllegalStateException()
-				.isThrownBy(() -> ClientRegistrations.fromIssuerLocation(this.issuer))
+				.isThrownBy(() -> ClientRegistrations.fromIssuerLocation(this.issuer).clientId("client-id").build())
 				.withMessageContaining("The Issuer \"https://example.com\" provided in the configuration metadata "
 						+ "did not match the requested issuer \"" + this.issuer + "\"");
 		// @formatter:on
@@ -601,6 +602,37 @@ public MockResponse dispatch(RecordedRequest request) {
 			.withMessageContaining("404");
 	}
 
+	@Test
+	public void issuerWhenOidcUsingCustomRestOperationsThenSuccess() {
+		this.issuer = createIssuerFromServer("issuer1");
+		this.response.put("issuer", this.issuer);
+		String body = this.mapper.writeValueAsString(this.response);
+		MockResponse mockResponse = new MockResponse().setBody(body)
+			.setHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE);
+		this.server.enqueue(mockResponse);
+		RestTemplate rest = new RestTemplate();
+		ClientRegistration registration = ClientRegistrations.fromOidcIssuerLocation(this.issuer, rest)
+			.clientId("client-id")
+			.clientSecret("client-secret")
+			.build();
+		assertThat(registration.getProviderDetails().getIssuerUri()).isEqualTo(this.issuer);
+	}
+
+	@Test
+	public void issuerWhenUsingCustomRestOperationsThenSuccess() {
+		this.issuer = createIssuerFromServer("issuer1");
+		this.response.put("issuer", this.issuer);
+		String body = this.mapper.writeValueAsString(this.response);
+		MockResponse mockResponse = new MockResponse().setBody(body)
+			.setHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE);
+		this.server.enqueue(mockResponse);
+		RestTemplate rest = new RestTemplate();
+		ClientRegistration registration = ClientRegistrations.fromIssuerLocation(this.issuer, rest)
+			.clientId("client-id")
+			.build();
+		assertThat(registration.getProviderDetails().getIssuerUri()).isEqualTo(this.issuer);
+	}
+
 	private ClientRegistration.Builder registration(String path) throws Exception {
 		this.issuer = createIssuerFromServer(path);
 		this.response.put("issuer", this.issuer);

oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtDecoderProviderConfigurationUtils.java

@@ -101,6 +101,10 @@ static int getReadTimeout() {
 	}
 
 	static Map<String, Object> getConfigurationForOidcIssuerLocation(String oidcIssuerLocation) {
+		return getConfigurationForOidcIssuerLocation(oidcIssuerLocation, rest);
+	}
+
+	static Map<String, Object> getConfigurationForOidcIssuerLocation(String oidcIssuerLocation, RestOperations rest) {
 		return getConfiguration(oidcIssuerLocation, rest, oidc(oidcIssuerLocation));
 	}