Skip to content

Version 2.7.1

Choose a tag to compare

View all tags
@nenaraab nenaraab released this 04 Jun 14:42
2.7.1
266084a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

2.7.1

  • [java-security]
    • XSUserInfoAdapter provides now the subdomain that is required for token exchange via getSubdomain() method.
    • Avoid warning messages "IAS Service is not yet supported!". #273
    • rename Token claim "sap_uid" to „user_uuid“.
    • Token Key Cache can now be customized via XsuaaTokenAuthenticator.
    • XSUserInfoAdapter supports requestTokenForUser() method.
    • set validators to package private, you can customize the JWT validators using the JwtValidatorBuilder.
    • Create validation results lazy. Avoid false warning validation results from JwtAudienceValidator (#290), e.g.
      Jwt token with audience [<appId>, uaa] is not issued for these clientIds: [<appId>].
  • [spring-xsuaa] Improve logs of Audience Validators.
  • [spring-xsuaa-starter] Upgrade Spring versions:
    • spring.boot.version: 2.2.6.RELEASE --> 2.3.0.RELEASE
    • spring.core.version: 5.2.5.RELEASE --> 5.2.6.RELEASE
    • spring.security.version: 5.3.1.RELEASE --> 5.3.2.RELEASE
    • spring.security.oauth2: 2.4.0.RELEASE -> 2.4.1.RELEASE
  • [spring-xsuaa-test]
    • renamed file privateKey.txt to spring-xsuaa-privateKey.txt and publicKey.txt to spring-xsuaa-publicKey.txt to avoid name clashes in context of CAP, which results in a strange IllegalArgumentException:failed to construct sequence from byte[]: DEF length 1213 object truncated by 2. This can happen when you use java-security-test and spring-xsuaa-test in parallel.
    • For new applications spring-xsuaa-test can be replaced in favor of java-security-test for unit testing. For testing your app locally you can setup your local environment with the VCAP_SERVICES in order to test with your XSUAA instance on Cloud Foundry.
  • [token-client]
    • more detailed debug logs and details to exception; decoded token gets logged.
    • supports optional scope parameter to reduce scopes that are provided via CientCredentialsTokenFlow or UserTokenFlow.
    • By default requested tokens are now cached. You can disable the cache globally or per request as described here.
    • never log an encoded token! Instead you can log the OAuth2TokenResponse itself: the toString() method provides the content of the decoded token (clear text). Be aware that this contains sensitive user data.
Assets 2
Loading