DMC/oauth2-authorization-server
0
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Implement support for user consent #4

Manually merged
ansv7779 merged 13 commits from user-consent into main 2025-04-25 10:22:44 +02:00
Conversation 0 Commits 13 Files Changed 31 +894 -57
ansv7779 commented 2025-04-24 16:37:35 +02:00
Owner
Copy Link

Clients now always require consent unless someone with developer access disables it.

Allows everyone to register new clients.

Clients now always require consent unless someone with developer access disables it. Allows everyone to register new clients.
ansv7779 added 13 commits 2025-04-24 16:37:36 +02:00 
Developers can decide if consent is required and for everyone else it is *always* required.
Add consent page (GUI)
All checks were successful
/ build (push) Successful in 2m6s
Details
0c55c25abf
Add proper tests for the consent page
All checks were successful
/ build (push) Successful in 1m50s
Details
e826ce523d 
The scope itself does nothing, without any of the additional OIDC scopes such as "profile" or "email" the ID token is completely empty. Therefore, it is unneccessary to ask for consent for it and it would just complicate matters. What would happen if a user consented to the "profile" scope but not the "openid" scope?
With the custom authorization in place, the current user is always the developer while the authorization request token may contain a custom principal. When Spring Authorization Server attempts to validate the submitted consent, it checks that the current user is the same as the authorization request token - which it is not. The easiest solution is to disable consent in staging for developers.
Handle consent token coming back during custom authorization flow
All checks were successful
/ build (push) Successful in 2m17s
Details
2ebf8c649d
Persist granted user consent
All checks were successful
/ build (push) Successful in 2m12s
Details
e79387bc2e
Allow everyone to register clients
All checks were successful
/ build (push) Successful in 2m16s
Details
c48eee489b
ansv7779 manually merged commit 18945e22bf into main 2025-04-25 10:22:44 +02:00
ansv7779 deleted branch user-consent 2025-04-28 12:08:06 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DMC/oauth2-authorization-server#4
No description provided.
Delete Branch "user-consent"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?