spring-projects/spring-security-oauth — pull request #246 by autayeu (2014-08-22 18:47:09+00:00)
Title: OAuth 1 provider refactoring from filters to end points (a-la OAuth2)

Github-226: https://github.com/spring-projects/spring-security-oauth/issues/226

# OAuth refactoring notes

## Migration for users with namespace configuration.
* Check security of OAuth end point URLs (most likely in applicationContext.xml, elements). See sparklr/applicationContext.xml example.
* request and access token endpoints need to be accessible to the consumer (they handle requests from the consumer (server), most likely authenticated only by OAuth signature)
* access confirmation and authorization end points need to be restricted to authorized users, most likely ROLE_USER or similar. They handle requests from the user (browser) and authenticated by standard Spring Security mechanism.

## Migration for users with manual bean configuration.
* Replace old filters with one OAuthProviderProcessingFilter (usually after ExceptionTranslationFilter) - it should process protected resources and at least request token and access token end point URLs.
* Check that FrameworkEndpointHandlerMapping registers end points URLs and they are properly and not overly protected by the interceptors (see above).
* Use FrameworkEndpointHandlerMapping.setMappings to customize end point URLs. See OAuthConstants.java for default URLs. Example:

* Wire beans to OAuthProviderProcessingFilter (e.g. tokenServices, consumerDetailsService, authHandler, frameworkEndpointHandlerMapping). Wire beans to end points: tokenServices for all; rememberMeServices, applicationEventPublisher, verifierServices, authenticationSuccessHandler, authenticationFailureHandler for AuthorizationEndpoint; if needed, configure require10a where present.

## Localization messages key changes

Messages have changed. The changed, removed and added keys follow (old = new):

AccessTokenProcessingFilter.missingToken = AccessTokenEndpoint.missingToken
AccessTokenProcessingFilter.missingVerifier = AccessTokenEndpoint.missingVerifier
AccessTokenProcessingFilter.missingVerifier = AccessTokenEndpoint.invalidVerifier
AccessTokenProcessingFilter.timestampNotNew = removed

OAuthProcessingFilter.missingConsumerKey = OAuthProviderProcessingFilter.missingConsumerKey
OAuthProcessingFilter.missingCredentials = OAuthProviderProcessingFilter.missingCredentials
OAuthProcessingFilter.incorrectRealm = OAuthProviderProcessingFilter.incorrectRealm
OAuthProcessingFilter.missingSignatureMethod = OAuthProviderProcessingFilter.missingSignatureMethod
OAuthProcessingFilter.missingSignature = OAuthProviderProcessingFilter.missingSignature
OAuthProcessingFilter.missingTimestamp = OAuthProviderProcessingFilter.missingTimestamp
OAuthProcessingFilter.missingNonce = OAuthProviderProcessingFilter.missingNonce
OAuthProcessingFilter.invalidTimestamp = OAuthProviderProcessingFilter.invalidTimestamp
OAuthProcessingFilter.timestampNotNew = removed

ProtectedResourceProcessingFilter.missingToken = OAuthProviderProcessingFilter.missingToken

AccessTokenProcessingFilter.missingCallback = RequestTokenEndpoint.missingCallback
new = RequestTokenEndpoint.missingCredentials

## Summary of changes for OAuth developers

### Architecture
Upgraded provider architecture: one filter (OAuthProviderProcessingFilter) and several end points (AbstractEndpoint subclasses, standard Spring MVC request mappings). OAuthProviderProcessingFilter processes signatures and loads authentication for framework end points and for protected resource requests.

### Code
* OAuthParameter.java - merged consumer and provider parameters, because they were used interchangeably.
* OAuthParameters.java - container for OAuth requests. POJO is faster than map.
* StringSplitUtils.java - refactored to use List instead of array to reduce memory allocations.
* OAuthProviderBeanDefinitionParser.java - upgraded to configure the refactored framework.
* CoreOAuthConsumerSupport.java - refactoring collateral.
* OAuthConsumerContextFilter.java - refactoring collateral.
* AbstractEndpoint.java - base class for framework end points.
* AccessTokenEndpoint.java - access token end point.
* AuthorizationEndpoint.java - token authorization end point.
* FrameworkEndpoint.java - annotation to mark framework end points. Includes a parameter to differ the ones not requiring OAuth signature.
* FrameworkEndpointHandlerMapping.java - handler mapping which sets up the end points.
* RequestTokenEndpoint.java - request token end point.
* UserAuthorizationSuccessfulAuthenticationHandler.java - moved.
* CoreOAuthProviderSupport.java - refactoring collateral.
* OAuthProviderProcessingFilter.java - core filter. Now a OncePerRequestFilter, processes OAuth signatures and loads consumer and user authentication when possible. Changes:
* removed allowedMethods. Now controlled by endpoints.
* removed filterProcessesUrl. Now protects both end points and resources.
* changed SecurityContext processing. Now a new context is established before OAuth processing and the whole context is saved-restored, not just Authentication.
* ConsumerAuthentication.java - refactoring collateral.
* OAuthProviderSupport.java - refactoring collateral.

There is a new dependency on spring-webmvc.

### Tests
* AuthorizationServerBeanDefinitionParserTests.java - refactoring collateral damage.
* CoreOAuthConsumerSupportTests.java - refactoring collateral damage.
* OAuthConsumerContextFilterTests.java - refactoring collateral damage.
* AccessTokenEndpointTests.java - increased code coverage.
* AuthorizationEndpointTests.java - increased code coverage.
* RequestTokenEndpointTests.java - increased code coverage.
* UserAuthorizationSuccessfulAuthenticationHandlerTests.java - refactoring collateral damage.
* OAuthProviderProcessingFilterTests.java - increased code coverage.
* CoreOAuthProviderSupportTests.java - increased code coverage.

Debug output is enabled in tests to increase code coverage and test debug clauses (construction of messages, etc).