Update OAuth20ProfileController.java

For the oauth2 /profile endpoint, if the access token is not in the request parameters, look for a bearer token in the authorization header. Allows the oauth2 support in CAS to be leveraged from spring-cloud/spring-cloud-security.
Yes, sorry if I wasn't clear. Different oauth providers implement this
callback differently since it's not part of the spec. spring-security-oauth
(via RemoteTokenServices) does a POST and sends the token in the form data
with name "token" instead of "access_token", plus it expects a client_id
back in the response. spring-cloud-oauth, which builds on
spring-security-oauth, provides another implementation which does a GET and
provides the token in the Authorization header. This is exactly what the
github oauth service uses btw. I think this second method is closer to what
the CAS oauth service does so I decided to map it here so that library
could be used to access the oauth2 support in CAS.

On Sat, Oct 11, 2014 at 11:10 AM, Misagh Moayyed <notifications@github.com>
wrote:

> In
> cas-server-support-oauth/src/main/java/org/jasig/cas/support/oauth/web/OAuth20ProfileController.java:
>
> > @@ -71,7 +71,14 @@ public OAuth20ProfileController(final TicketRegistry ticketRegistry) {
> >      protected ModelAndView handleRequestInternal(final HttpServletRequest request, final HttpServletResponse response)
> >              throws Exception {
> >
> > -        final String accessToken = request.getParameter(OAuthConstants.ACCESS_TOKEN);
> > +        String accessToken = request.getParameter(OAuthConstants.ACCESS_TOKEN);
> > +        if (StringUtils.isBlank(accessToken)) {
> > +            // try getting the bearer token from the authorization header
> > +            String authHeader = request.getHeader("Authorization");
> > +            if (authHeader != null && authHeader.startsWith("bearer ")) {
>
> Not sure I follow. You seem to be describing a use case related to
> spring-cloud/spring-cloud-security. Care to elaborate? Is this header
> something that is set by either of those two library? Do they have
> exact/specific names? Can we collect a list and retrieve them here?
>
> calling a substring of 7 characters on something that starts with "bearer"
> is very confusing at best in the log run. Before building any kind of
> support for this, we should make clear why this is needed.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/Jasig/cas/pull/721/files#r18742039>.
>