Skip to content

Version 2.8.0

Choose a tag to compare

View all tags
@liga-oz liga-oz released this 26 Nov 16:16
2.8.0
974227d
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
  • [java-security]
    • getClientId() method was added to Token interface. getClientId() method should be used instead of getClaimAsString(TokenClaims.XSUAA.CLIENT_ID). TokenClaims.XSUAA.CLIENT_ID is deprecated.
    • Supports IAS token validation. IAS_SERVICE_NAME has not be provided any longer. You can find a sample here.
  • [java-security-test] In case you like to overwrite the client id using JwtGenerator using withClaimValue() or withClaimValues() method, it's recommended to set the azp claim instead using withClaimValue(TokenClaims.AUTHORIZATION_PARTY, "T000310").
  • [spring-xsuaa]
    • getClientId() method implementation of Token interface has been changed. Using azp and as fallback aud and cid claims to obtain client id.
  • ⚠️ backward incompatible change: usage of deprecated org.springframework.security.oauth:spring-security-oauth2 dependency in OAuth2AuthenticationConverter was removed.
    OAuth2AuthenticationConverter.convert() method return type has changed from org.springframework.security.oauth2.provider.OAuth2Authentication to org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthentication
    • Migration tips
      • when necessary, org.springframework.security.oauth:spring-security-oauth2 dependency need to be provided explicitly
      • OAuth2WebSecurityExpressionHandler() won't work in conjunction with OAuth2AuthenticationConverter, as it expects OAuth2Authentication class instead of BearerTokenAuthentication when deriving authorization claims. Use hasAuthority() or hasAnyAuthority() instead of explicitly defined expressionHandler(new OAuth2WebSecurityExpressionHandler()) and access() expression for authorized requests.
  • The following dependency was removed:
    • org.springframework.security.oauth:spring-security-oauth2
  • The following dependencies were updated:
    • spring.boot.version 2.3.4.RELEASE --> 2.3.5.RELEASE
    • spring.core.version 5.2.9.RELEASE --> 5.2.10.RELEASE
    • spring.security.version 5.3.4.RELEASE --> 5.3.5.RELEASE
    • caffeine.version 2.8.2 --> 2.8.6
Assets 2
Loading