spring_boot_starter_oauth2_client 0.6.2

OAuth 2.0 and OpenID Connect clients for spring_boot_dart: registrations from spring.security.oauth2.client.*, every grant, token refresh, Bearer tokens on Feign calls.

0.6.2

• feat: 0.6.2 — the theme (typed keys and messages, states, every component, a theme from a URL), (#20)

0.6.1

• No changes of its own; released with the family version 0.6.1.

0.6.0

Breaking

• Properties renamed: spring.cloud.openfeign.oauth2.* is spring.feign.oauth2.* (enabled, client-registration-id; Spring Cloud means nothing in Dart). An old name stops the start, naming the new one.

Changes

• Checked against Project Wycheproof's test vectors (Apache-2.0, test/fixtures/wycheproof/): ES256 and RS256 verification of ID tokens, the conversion of DER ECDSA signatures of platform keys (ECDSA.transcodeSignatureToConcat) followed by verification, and the signatures of the software DPoP key and the JWT client secret (64-byte R || S, deterministic, valid): no bug found.
• Debug lines for the main steps, never with a secret: the token request (Sending the authorization_code token request of registration keycloak to sso.test/token, the status of the answer), the discovery documents and JWK Sets fetched (host, path, status, key count), and a refresh of an access token. The query of a URL, tokens, codes, the client secret and its JWT are never logged.

0.5.0

Breaking

• JwkSetOidcIdTokenDecoder (the app-side ID token decoder, used for Sign in with Apple) refuses an ID token whose typ header is not JWT (in any case), blank or missing, as Spring Security 7.1 checks ID tokens: a logout+jwt, at+jwt or secevent+jwt token signed with the same keys is no ID token.

Changes

• client-secret-jwt.* set by environment variables (..._REGISTRATION_APPLE_CLIENTSECRETJWT_ISSUER, also ..._CLIENT_SECRET_JWT_...) was not found: the starter looked for the registrations by the exact key client-secret-jwt, so the clientSecretResolver bean was missing and Sign in with Apple sent an empty client_secret. The keys are now compared without dashes, dots and case, as relaxed binding does.
• JwkSetOidcIdTokenDecoder leaves out RSA keys whose exponent is 1, even or over 64 bits.
• InMemoryClientRegistrationRepository calls a failed supplier (a discovery of an issuer-uri) again only retryAfterFailure later (10 seconds by default); calls in between get its error at once, so a provider that is down never gets one request per login started. clock lets tests move time.
• That pause and the JWK Set's refetch interval are measured on a monotonic clock, so a device clock set back does not make them last hours.

0.4.3

• A registration whose issuer, authorization, token, JWK Set, user-info or redirect URI uses plain http:// on a host other than localhost, 127.0.0.1 or [::1] is logged as a warning, once per registration (it still works). ClientRegistrations.configurationForIssuerLocation: the metadata lookup of the issuer discovery (the three locations, the issuer check), public so the security starter's resource server uses the same code. The discovery URLs no longer end in an empty ?.
• DPoP on the client's side (RFC 9449; an addition, Spring Security 7 has none): DPoPKey, SoftwareDPoPKey (ES256 in Dart, RFC 6979 nonces, toJwk / fromJwk), DPoPProofBuilder, ECDSA.transcodeSignatureToConcat (DER to raw R || S), DPoPMode and ClientRegistration.dpop from the registration's dpop property (off by default; auto: on when the provider's metadata lists ES256 in dpop_signing_alg_values_supported). The token response clients send proofs and answer use_dpop_nonce once, the user services and the Feign interceptor send Authorization: DPoP <token> with a proof, the error decoder remembers DPoP-Nonce per server; OAuth2AccessTokenResponse reads token_type: DPoP (TokenType.dpop). New bean dPoPKey (a key per run, in memory; ConditionalOnMissingBean). OAuth2ErrorCodes.invalidDPoPProof, useDPoPNonce. auto by default: on when the provider announces DPoP and the key outlives the program (DPoPKey.persistent: the apps' keys of the Flutter security package), so servers, whose default key lives for one run, keep Bearer unless dpop=true. LoadableDPoPKey (a key made or read on first use; DPoPProofBuilder awaits its load()), OAuth2AccessTokenHeaders (the Authorization and DPoP headers of a token for a request the starter does not make: a WebSocket handshake, a call of your own; the Feign interceptor uses it), and ws / wss URLs in proofs as http / https (htu is the handshake's HTTP URI).
• First version: OAuth 2.0 and OpenID Connect clients from Spring Boot's spring.security.oauth2.client.* properties (ClientRegistration, CommonOAuth2Provider, issuer discovery at first use), the token endpoint (authorization_code with PKCE, refresh_token, client_credentials; client_secret_basic, client_secret_post, none), authorized clients (InMemoryOAuth2AuthorizedClientService) refreshed by AuthorizedClientServiceOAuth2AuthorizedClientManager (one refresh at a time), OAuth 2.0 and OIDC users with OidcIdTokenValidator and TokenEndpointOidcIdTokenDecoder, the shared DPoP types (JwkThumbprint, DPoPProofClaims), and OAuth2AccessTokenInterceptor for Feign (spring.cloud.openfeign.oauth2.*). The login of apps (OAuth2LoginService, AuthorizationWindow, SecretStore, SecretTemplate) is in spring_boot_starter_flutter_security.