The new ["modular design"](https://spring.io/blog/2025/10/28/modularizing-spring-boot/) required a few changes in the starter Maven dependencies. It also caused some minor Java import changes. The main problem that arose was that the spring-boot-web-server dependency got scoped to "runtime" in Maven. This broke the embedded Docker build since it was excluded from dependency lists. Therefore, it had to be manually added back in the correct "provided" scope.
spring-boot-starter-web, JTE, and Testcontainers had new artifact names. Jackson had to be added as an explicit dependency (for testing only) since it's no longer included by default in Spring Boot.
## Spring Boot OAuth 2.0 Authorization Server
There were some internal changes that broke the "custom" developer authorization. The OAuth2AuthorizationEndpointFilter got split into two separate ones (for MFA purposes), and the split off one is executed much much earlier in the chain. Therefore, the old method of changing the HTTP method of the request to trick the regular filter from the custom one no longer works. Luckily an unrelated change had added POST support to the OAuth2AuthorizationEndpointFilter which meant we could stop changing the HTTP method and change the form to submit everything as form fields instead of query parameters. A lot of mechanical changes in the tests were required for this.
MFA support also meant that OIDC ID tokens require the authenticated principal to have a FactorGrantedAuthority which was added to the Shibboleth authentication.
Lastly the default for clients changed to require PKCE, this was turned off in the tests to match production (not required for clients with credentials).
Reviewed-by: Stefan Nenzén <nenzen@dsv.su.se>
Reviewed-on: #18
Allow developers to add this as a service to their Docker Compose file to enable local OAuth 2.0 flows.
See the following example:
```
services:
oauth2:
build: https://gitea.dsv.su.se/DMC/oauth2-authorization-server.git
restart: unless-stopped
ports:
- "<host_port>:8080"
environment:
CLIENT_ID=awesome-app
CLIENT_SECRET=p4ssw0rd
CLIENT_REDIRECT_URI=http://localhost/oauth2/callback
```
Reviewed-on: #1
ansv7779
