Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change default authority for oauth2Login() #11887

Closed

Conversation

sjohnr
Copy link
Member

@sjohnr sjohnr commented Sep 21, 2022

Previously, the default authority was ROLE_USER when using oauth2Login() for both OAuth2 and OIDC providers.

  • Default authority for OAuth2UserAuthority is now OAUTH2_USER
  • Default authority for OidcUserAuthority is now OIDC_USER

Documentation has been updated to include this implementation detail.

Closes gh-7856

@sjohnr sjohnr added status: duplicate A duplicate of another issue in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: breaks-passivity A change that breaks passivity with the previous release labels Sep 21, 2022
@sjohnr sjohnr added this to the 6.0.x milestone Sep 21, 2022
@sjohnr sjohnr self-assigned this Sep 21, 2022
@sjohnr sjohnr force-pushed the gh-7856-oidc-user-authority branch 2 times, most recently from 21555d9 to 6df7a92 Compare September 21, 2022 16:27
Previously, the default authority was ROLE_USER when using
oauth2Login() for both OAuth2 and OIDC providers.

* Default authority for OAuth2UserAuthority is now OAUTH2_USER
* Default authority for OidcUserAuthority is now OIDC_USER

Documentation has been updated to include this implementation detail.

Closes spring-projectsgh-7856
Copy link
Contributor

@jgrandja jgrandja left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @sjohnr.

There are 2 minor updates needed and then please go ahead and merge.

Thanks!

@sjohnr
Copy link
Member Author

sjohnr commented Sep 26, 2022

Merged via 181ee74.

@sjohnr sjohnr closed this Sep 26, 2022
@sjohnr sjohnr deleted the gh-7856-oidc-user-authority branch September 26, 2022 15:09
@sjohnr sjohnr modified the milestones: 6.0.x, 6.0.0-RC1 Sep 27, 2022
sjohnr added a commit to sjohnr/spring-security that referenced this pull request Nov 10, 2022
sjohnr added a commit that referenced this pull request Nov 14, 2022
sjohnr added a commit that referenced this pull request Nov 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) status: duplicate A duplicate of another issue type: breaks-passivity A change that breaks passivity with the previous release
Projects
None yet
Development

Successfully merging this pull request may close these issues.

OidcUserAuthority should not automatically include ROLE_USER authority
2 participants