Skip to content

Add authentication validator hook to OAuth2TokenExchangeAuthenticationProvider#19217

Open
rakesh-rsky wants to merge 1 commit into
spring-projects:mainfrom
rakesh-rsky:gh-18879-token-exchange-auth-validator
Open

Add authentication validator hook to OAuth2TokenExchangeAuthenticationProvider#19217
rakesh-rsky wants to merge 1 commit into
spring-projects:mainfrom
rakesh-rsky:gh-18879-token-exchange-auth-validator

Conversation

@rakesh-rsky
Copy link
Copy Markdown

@rakesh-rsky rakesh-rsky commented May 25, 2026

Add authentication validator hook to OAuth2TokenExchangeAuthenticationProvider

Add setAuthenticationValidator(Consumer) to OAuth2TokenExchangeAuthenticationProvider, consistent with the existing pattern on OAuth2ClientCredentialsAuthenticationProvider and OAuth2AuthorizationCodeRequestAuthenticationProvider.

This introduces:

  • OAuth2TokenExchangeAuthenticationContext: holds the authentication token, registered client, subject authorization, and optional actor authorization
  • OAuth2TokenExchangeAuthenticationValidator: the default Consumer that validates requested scopes against the registered client's allowed scopes
  • setAuthenticationValidator() on the provider for custom validation hooks

Closes gh-18879

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label May 25, 2026
…nProvider

Add setAuthenticationValidator(Consumer) to OAuth2TokenExchangeAuthenticationProvider,
consistent with the existing pattern on OAuth2ClientCredentialsAuthenticationProvider
and OAuth2AuthorizationCodeRequestAuthenticationProvider.

This introduces:
- OAuth2TokenExchangeAuthenticationContext: holds the authentication token,
  registered client, subject authorization, and optional actor authorization
- OAuth2TokenExchangeAuthenticationValidator: the default Consumer that
  validates requested scopes against the registered client's allowed scopes
- setAuthenticationValidator() on the provider for custom validation hooks

Closes spring-projectsgh-18879

Signed-off-by: Rakesh Kumar Singh <rsky.rakesh@gmail.com>
@rakesh-rsky rakesh-rsky force-pushed the gh-18879-token-exchange-auth-validator branch from 2c99eda to ed625f4 Compare May 25, 2026 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: waiting-for-triage An issue we've not yet triaged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add an authentication validator hook to OAuth2TokenExchangeAuthenticationProvider

2 participants