|
|
@@ -69,9 +69,10 @@ public class RegisteredClient implements Serializable {
|
|
|
private Set<ClientAuthenticationMethod> clientAuthenticationMethods; <7>
|
|
|
private Set<AuthorizationGrantType> authorizationGrantTypes; <8>
|
|
|
private Set<String> redirectUris; <9>
|
|
|
- private Set<String> scopes; <10>
|
|
|
- private ClientSettings clientSettings; <11>
|
|
|
- private TokenSettings tokenSettings; <12>
|
|
|
+ private Set<String> postLogoutRedirectUris; <10>
|
|
|
+ private Set<String> scopes; <11>
|
|
|
+ private ClientSettings clientSettings; <12>
|
|
|
+ private TokenSettings tokenSettings; <13>
|
|
|
|
|
|
...
|
|
|
|
|
|
@@ -86,9 +87,10 @@ public class RegisteredClient implements Serializable {
|
|
|
<7> `clientAuthenticationMethods`: The authentication method(s) that the client may use. The supported values are `client_secret_basic`, `client_secret_post`, https://datatracker.ietf.org/doc/html/rfc7523[`private_key_jwt`], `client_secret_jwt`, and `none` https://datatracker.ietf.org/doc/html/rfc7636[(public clients)].
|
|
|
<8> `authorizationGrantTypes`: The https://datatracker.ietf.org/doc/html/rfc6749#section-1.3[authorization grant type(s)] that the client can use. The supported values are `authorization_code`, `client_credentials`, `refresh_token`, and `urn:ietf:params:oauth:grant-type:device_code`.
|
|
|
<9> `redirectUris`: The registered https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2[redirect URI(s)] that the client may use in redirect-based flows – for example, `authorization_code` grant.
|
|
|
-<10> `scopes`: The scope(s) that the client is allowed to request.
|
|
|
-<11> `clientSettings`: The custom settings for the client – for example, require https://datatracker.ietf.org/doc/html/rfc7636[PKCE], require authorization consent, and others.
|
|
|
-<12> `tokenSettings`: The custom settings for the OAuth2 tokens issued to the client – for example, access/refresh token time-to-live, reuse refresh tokens, and others.
|
|
|
+<10> `postLogoutRedirectUris`: The post logout redirect URI(s) that the client may use for logout.
|
|
|
+<11> `scopes`: The scope(s) that the client is allowed to request.
|
|
|
+<12> `clientSettings`: The custom settings for the client – for example, require https://datatracker.ietf.org/doc/html/rfc7636[PKCE], require authorization consent, and others.
|
|
|
+<13> `tokenSettings`: The custom settings for the OAuth2 tokens issued to the client – for example, access/refresh token time-to-live, reuse refresh tokens, and others.
|
|
|
|
|
|
[[registered-client-repository]]
|
|
|
== RegisteredClientRepository
|
|
|
@@ -491,3 +493,34 @@ If the `OAuth2TokenGenerator` is not provided as a `@Bean` or is not configured
|
|
|
|
|
|
[TIP]
|
|
|
For an example showing how you can xref:guides/how-to-userinfo.adoc#customize-id-token[customize the ID token], see the guide xref:guides/how-to-userinfo.adoc#how-to-userinfo[How-to: Customize the OpenID Connect 1.0 UserInfo response].
|
|
|
+
|
|
|
+[[session-registry]]
|
|
|
+== SessionRegistry
|
|
|
+
|
|
|
+If OpenID Connect 1.0 is enabled, a `SessionRegistry` instance is used to track authenticated sessions.
|
|
|
+The `SessionRegistry` is used by the default implementation of `SessionAuthenticationStrategy` associated to the xref:protocol-endpoints.adoc#oauth2-authorization-endpoint[OAuth2 Authorization Endpoint] for registering new authenticated sessions.
|
|
|
+
|
|
|
+[NOTE]
|
|
|
+If a `SessionRegistry` `@Bean` is not registered, the default implementation `SessionRegistryImpl` will be used.
|
|
|
+
|
|
|
+[IMPORTANT]
|
|
|
+If a `SessionRegistry` `@Bean` is registered and is an instance of `SessionRegistryImpl`, a `HttpSessionEventPublisher` `@Bean` *SHOULD* also be registered as it's responsible for notifying `SessionRegistryImpl` of session lifecycle events, for example, `SessionDestroyedEvent`, to provide the ability to remove the `SessionInformation` instance.
|
|
|
+
|
|
|
+When a logout is requested by an End-User, the xref:protocol-endpoints.adoc#oidc-logout-endpoint[OpenID Connect 1.0 Logout Endpoint] uses the `SessionRegistry` to lookup the `SessionInformation` associated to the authenticated End-User to perform the logout.
|
|
|
+
|
|
|
+If Spring Security's {spring-security-reference-base-url}/servlet/authentication/session-management.html#ns-concurrent-sessions[Concurrent Session Control] feature is being used, it is *RECOMMENDED* to register a `SessionRegistry` `@Bean` to ensure it's shared between Spring Security's Concurrent Session Control and Spring Authorization Server's Logout feature.
|
|
|
+
|
|
|
+The following example shows how to register a `SessionRegistry` `@Bean` and `HttpSessionEventPublisher` `@Bean` (required by `SessionRegistryImpl`):
|
|
|
+
|
|
|
+[source,java]
|
|
|
+----
|
|
|
+@Bean
|
|
|
+public SessionRegistry sessionRegistry() {
|
|
|
+ return new SessionRegistryImpl();
|
|
|
+}
|
|
|
+
|
|
|
+@Bean
|
|
|
+public HttpSessionEventPublisher httpSessionEventPublisher() {
|
|
|
+ return new HttpSessionEventPublisher();
|
|
|
+}
|
|
|
+----
|
Joe Grandja