Support client authentication methods CLIENT_SECRET_POST and CLIENT_S…

…ECRET_BASIC

powerauth-restful-security-spring/src/main/java/io/getlime/security/powerauth/rest/api/spring/service/oidc/ClientAuthenticationMethod.java

@@ -0,0 +1,37 @@
+/*
+ * PowerAuth integration libraries for RESTful API applications, examples and
+ * related software components
+ *
+ * Copyright (C) 2024 Wultra s.r.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+package io.getlime.security.powerauth.rest.api.spring.service.oidc;
+
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+/**
+ * OIDC client authentication methods.
+ *
+ * @author Lubos Racansky, [email protected]
+ */
+enum ClientAuthenticationMethod {
+
+    @JsonProperty("client_secret_basic")
+    CLIENT_SECRET_BASIC,
+
+    @JsonProperty("client_secret_post")
+    CLIENT_SECRET_POST
+
+}

powerauth-restful-security-spring/src/main/java/io/getlime/security/powerauth/rest/api/spring/service/oidc/OAuth2Handler.java

@@ -62,6 +62,7 @@ public String retrieveUserId(final OAuth2ActivationContext request) throws Power
                 .clientId(oidcApplicationConfiguration.getClientId())
                 .code(request.getCode())
                 .clientSecret(oidcApplicationConfiguration.getClientSecret())
+                .clientAuthenticationMethod(oidcApplicationConfiguration.getClientAuthenticationMethod())
                 .tokenUrl(oidcApplicationConfiguration.getTokenUri())
                 .redirectUri(oidcApplicationConfiguration.getRedirectUri())
                 .build();

powerauth-restful-security-spring/src/main/java/io/getlime/security/powerauth/rest/api/spring/service/oidc/OAuth2TokenClient.java

@@ -21,9 +21,10 @@
 
 import com.wultra.core.rest.client.base.DefaultRestClient;
 import com.wultra.core.rest.client.base.RestClient;
+import com.wultra.core.rest.client.base.RestClientConfiguration;
 import com.wultra.core.rest.client.base.RestClientException;
+import lombok.AllArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.ParameterizedTypeReference;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
@@ -38,15 +39,11 @@
  * @author Lubos Racansky, [email protected]
  */
 @Component
+@AllArgsConstructor
 @Slf4j
 class OAuth2TokenClient {
 
-    private final RestClient restClient;
-
-    @Autowired
-    public OAuth2TokenClient(final OAuth2ActivationConfigurationProperties configurationProperties) throws RestClientException {
-        restClient = new DefaultRestClient(configurationProperties.getRestClientConfig());
-    }
+    private OAuth2ActivationConfigurationProperties configurationProperties;
 
     /**
      * Call token endpoint using {@code authorization_code} flow. Mind that <strong>the token is not verified yet</strong>.
@@ -59,13 +56,21 @@ TokenResponse fetchTokenResponse(final TokenRequest tokenRequest) throws RestCli
         final HttpHeaders headers = new HttpHeaders();
         headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
 
+        final ClientAuthenticationMethod clientAuthenticationMethod = tokenRequest.getClientAuthenticationMethod();
+        logger.debug("Using ClientAuthenticationMethod: {}", clientAuthenticationMethod);
+
         final MultiValueMap<String, String> map = new LinkedMultiValueMap<>();
         map.add("grant_type", "authorization_code");
         map.add("client_id", tokenRequest.getClientId());
-        map.add("client_secret", tokenRequest.getClientSecret());
         map.add("code", tokenRequest.getCode());
         map.add("redirect_uri", tokenRequest.getRedirectUri());
 
+        if (clientAuthenticationMethod == ClientAuthenticationMethod.CLIENT_SECRET_POST) {
+            map.add("client_secret", tokenRequest.getClientSecret());
+        }
+
+        final RestClient restClient = createRestClient(tokenRequest, clientAuthenticationMethod);
+
         final String tokenUrl = tokenRequest.getTokenUrl();
         logger.debug("Calling token endpoint: {}", tokenUrl);
         final ResponseEntity<TokenResponse> response = restClient.post(tokenUrl, map, null, headers, new ParameterizedTypeReference<>(){});
@@ -77,4 +82,13 @@ TokenResponse fetchTokenResponse(final TokenRequest tokenRequest) throws RestCli
 
         return response.getBody();
     }
+
+    private RestClient createRestClient(final TokenRequest tokenRequest, ClientAuthenticationMethod clientAuthenticationMethod) throws RestClientException {
+        final RestClientConfiguration restClientConfiguration = configurationProperties.getRestClientConfig();
+        restClientConfiguration.setHttpBasicAuthEnabled(clientAuthenticationMethod == null || clientAuthenticationMethod == ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
+        restClientConfiguration.setHttpBasicAuthUsername(tokenRequest.getClientId());
+        restClientConfiguration.setHttpBasicAuthPassword(tokenRequest.getClientSecret());
+
+        return new DefaultRestClient(restClientConfiguration);
+    }
 }

powerauth-restful-security-spring/src/main/java/io/getlime/security/powerauth/rest/api/spring/service/oidc/OidcApplicationConfiguration.java

@@ -34,6 +34,7 @@ public class OidcApplicationConfiguration {
     private String providerId;
     private String clientId;
     private String clientSecret;
+    private ClientAuthenticationMethod clientAuthenticationMethod;
     private String issuerUri;
     private String tokenUri;
     private String redirectUri;

powerauth-restful-security-spring/src/main/java/io/getlime/security/powerauth/rest/api/spring/service/oidc/TokenRequest.java

@@ -33,6 +33,7 @@ class TokenRequest {
 
     private String clientId;
     private String clientSecret;
+    private ClientAuthenticationMethod clientAuthenticationMethod;
     private String code;
     private String tokenUrl;
     private String redirectUri;