diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterConfiguration.java index 3ffb6e0e9e5..ae9edb8d324 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterConfiguration.java @@ -147,6 +147,11 @@ class JwtConverterConfiguration { } + @ConditionalOnProperty("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter") + static class OnAuthoritiesClaimDelimiter { + + } + @Conditional(OnAuthoritiesExpressionsCondition.class) static class OnAuthoritiesExpressions { diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveJwtConverterConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveJwtConverterConfiguration.java index 9ff24500f90..b313a6bf08b 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveJwtConverterConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveJwtConverterConfiguration.java @@ -153,6 +153,11 @@ class ReactiveJwtConverterConfiguration { } + @ConditionalOnProperty("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter") + static class OnAuthoritiesClaimDelimiter { + + } + @Conditional(OnAuthoritiesExpressionsCondition.class) static class OnAuthoritiesExpressions { diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java index 23f56974a46..a0df6bb7069 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java @@ -53,7 +53,7 @@ public final class JwtConverterCustomizationsArgumentsProvider implements Argume String principalClaimProperty = "spring.security.oauth2.resourceserver.jwt.principal-claim-name=" + customPrincipalClaim; String[] customPrefixProps = { jwkSetUriProperty, authorityPrefixProperty }; - String[] customDelimiterProps = { jwkSetUriProperty, authorityPrefixProperty, authoritiesDelimiterProperty }; + String[] customDelimiterProps = { jwkSetUriProperty, authoritiesDelimiterProperty }; String[] customAuthoritiesClaimProps = { jwkSetUriProperty, authoritiesClaimProperty }; String[] customPrincipalClaimProps = { jwkSetUriProperty, principalClaimProperty }; String[] allJwtConverterProps = { jwkSetUriProperty, authorityPrefixProperty, authoritiesDelimiterProperty, @@ -84,7 +84,7 @@ public final class JwtConverterCustomizationsArgumentsProvider implements Argume Arguments.of(Named.named("Custom prefix for GrantedAuthority", customPrefixProps), noAuthoritiesCustomizationsJwt, subjectValue, customPrefixAuthorities), Arguments.of(Named.named("Custom delimiter for JWT scopes", customDelimiterProps), - customAuthoritiesDelimiterJwt, subjectValue, customPrefixAuthorities), + customAuthoritiesDelimiterJwt, subjectValue, defaultPrefixAuthorities), Arguments.of(Named.named("Custom JWT authority claim name", customAuthoritiesClaimProps), customAuthoritiesClaimJwt, subjectValue, defaultPrefixAuthorities), Arguments.of(Named.named("Custom JWT principal claim name", customPrincipalClaimProps), diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerAutoConfigurationTests.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerAutoConfigurationTests.java index a4900f10a34..3d9e8de6019 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerAutoConfigurationTests.java @@ -783,6 +783,13 @@ class OAuth2ResourceServerAutoConfigurationTests { .isInstanceOf(MutuallyExclusiveConfigurationPropertiesException.class)); } + @Test + void shouldConfigureJwtConverterIfAuthoritiesClaimDelimiterIsSet() { + this.contextRunner + .withPropertyValues("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter=dummy") + .run((context) -> assertThat(context).hasSingleBean(JwtAuthenticationConverter.class)); + } + @Test void jwtAuthenticationConverterByJwtConfigIsConditionalOnMissingBean() { String propertiesPrincipalClaim = "principal_from_properties"; diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java index ef1ab88f750..2ccaa5255c9 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java @@ -800,6 +800,13 @@ class ReactiveOAuth2ResourceServerAutoConfigurationTests { .isInstanceOf(MutuallyExclusiveConfigurationPropertiesException.class)); } + @Test + void shouldConfigureJwtConverterIfAuthoritiesClaimDelimiterIsSet() { + this.contextRunner + .withPropertyValues("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter=dummy") + .run((context) -> assertThat(context).hasSingleBean(ReactiveJwtAuthenticationConverter.class)); + } + @ParameterizedTest(name = "{0}") @ArgumentsSource(JwtConverterCustomizationsArgumentsProvider.class) void autoConfigurationShouldConfigureResourceServerWithJwtConverterCustomizations(String[] properties, Jwt jwt,