adaptivecomputing/grails-spring-security-oauth2-provider — pull request #28 by bobby-vandiver (2014-05-27 01:28:57+00:00)
Title: GORM Support and More!

This pull request includes the following major changes to the plugin:

* Configurable Grails domain classes for OAuth2 clients, access tokens, refresh tokens and authorization codes

- Consequently, this required the removal of static client registration in `Config.groovy`

* Script to generate required domain classes (`s2-init-oauth2-provider`)

* GORM backed TokenStore, ClientDetailsService, and AuthorizationCodeServices implementations

- Each is implemented as a Grails service

* Client secrets are now encoded using the encoding strategy configured for Spring Security Core plugin

* HandlerExceptionResolver implementations to properly integrate with Spring MVC endpoint controllers for error handling

- Fixes issue #23

- This required introducing endpoint specific exceptions and wrapping any exceptions thrown by
each endpoint so the custom resolvers would handle thrown exceptions of the same type, e.g. `OAuth2Exception`,
thrown from different endpoints appropriately.

* Explicit wiring of beans rather than rely on Spring OAuth's XML DSL

- Allows custom implementations of the `AuthorizationRequestManager` and other classes to be configured properly

- Opens the door for supporting custom and extension grant types in the future

* Additional restrictions on client redirect URI and scope param per security considerations in spec

- Addresses [RFC 6749 Section 10.6: Authorization Code Redirection URI Manipulation](http://tools.ietf.org/html/rfc6749#section-10.6)

- Addresses [RFC 6749 Section 10.15: Open Redirectors](http://tools.ietf.org/html/rfc6749#section-10.15)

* Change default client config to not allow any authorized grant types

- This is consistent with the pessimistic default behavior of the Core plugin,
forcing developers to intentionally grant access to resources and grant types.

* Do not reuse refresh tokens by default

* Ensure the token endpoint is stateless

* Documentation for plugin

- Includes all of the information that was contained in the original README,
updated to take into consideration support for GORM rather than in-memory implementations.

- Updated the README to refer back to the documentation for the most up-to-date information

* Automated functional tests and test app creation for Grails version 2.0.x - 2.3.x

- This is based heavily on @burtbeckwith's test apps script from the Core plugin

- [Here](https://gist.github.com/bobby-vandiver/ac628367be7f9878f662) is a simple shell script wrapping
the provided script to simplify creating applications and testing them automatically.

- The recent release (2.0-RC3) of the Core plugin introduces a few compilation issues

* Removed example apps and Scribe script

- The functionality being tested by this script is covered in the functional test suite

I apologize for the sheer size of this pull request. I hope this allows other developers to easily create
scalable Grails applications that are OAuth 2.0 providers. Additionally, I was not able to find any information on the best practice for including authorship information.

I look forward to the community's feedback. :)