Spring Security OAuth 2.0.4.RELEASE Available Now
Spring Security OAuth 2.0.4.RELEASE is available now in the usual repositories. It's a bug fix release, so upgrading is recommended, but there is also a small set of new features:
- The
OAuth2Request
(and henceOAuth2Authentication
) can now be
queried explicitly to find the grant type for the associated
token. If the token is being refreshed the grant type in the
OAuth2Request
presented to a TokenEnhancer
is the
original grant type, not "refresh_token".
-
The client authorities are exposed in the "/check_token" endpoint
-
Password grants are more flexible and open to extension because both client and server can add additional parameters to the request. A custom
AuthenticationManager
on the server side should still expect aUsernamePasswordAuthenticationToken
, but the additional parameters will be available in theAuthenticationDetails
. Multi-factor authentication for mobile devices could be implemented in this way, for instance. -
Keystore support for JWT token signing and verification.
…