Skip to content

Upgrade to Java 21, Spring Security 7.0.4, Spring Framework 7.0.6 with Jakarta EE migration #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Upgrade to Java 21, Spring Security 7.0.4, Spring Framework 7.0.6 with Jakarta EE migration #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
16f9dea
Initial plan
Copilot Mar 22, 2026
a52cfcd
Upgrade to Spring Security 7.0.4, Spring Framework 7.0.6, Java 21, Ja…
Copilot Mar 22, 2026
ae77173
Fix IntrospectingTokenService syntax errors from automated sed
Copilot Mar 22, 2026
670a49b
Fix vulnerabilities: bump gson to 2.8.9, mysql-connector to 8.2.0, po…
Copilot Mar 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions openid-connect-client/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,7 @@
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>${java-version}</source>
<target>${java-version}</target>
<release>${java-version}</release>
</configuration>
</plugin>
<!-- BUILD SOURCE FILES -->
Expand Down
17 changes: 3 additions & 14 deletions ...-client/src/main/java/org/mitre/oauth2/introspectingfilter/IntrospectingTokenService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,6 @@
import java.util.Map;
import java.util.Set;

import org.apache.http.client.HttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.mitre.oauth2.introspectingfilter.service.IntrospectionAuthorityGranter;
import org.mitre.oauth2.introspectingfilter.service.IntrospectionConfigurationService;
import org.mitre.oauth2.introspectingfilter.service.impl.SimpleIntrospectionAuthorityGranter;
Expand All @@ -38,7 +36,6 @@
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpMethod;
import org.springframework.http.client.ClientHttpRequest;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
Expand Down Expand Up @@ -74,15 +71,7 @@ public class IntrospectingTokenService implements ResourceServerTokenServices {
private boolean cacheNonExpiringTokens = false;
private boolean cacheTokens = true;

private HttpComponentsClientHttpRequestFactory factory;

public IntrospectingTokenService() {
this(HttpClientBuilder.create().useSystemProperties().build());
}

public IntrospectingTokenService(HttpClient httpClient) {
this.factory = new HttpComponentsClientHttpRequestFactory(httpClient);
}
private RestTemplate restTemplate = new RestTemplate();

// Inner class to store in the hash map
private class TokenCacheObject {
Expand Down Expand Up @@ -289,7 +278,7 @@ private TokenCacheObject parseToken(String accessToken) {

if (SECRET_BASIC.equals(client.getTokenEndpointAuthMethod())){
// use BASIC auth if configured to do so
restTemplate = new RestTemplate(factory) {
restTemplate = new RestTemplate() {

@Override
protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOException {
Expand All @@ -300,7 +289,7 @@ protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOE
}
};
} else { //Alternatively use form based auth
restTemplate = new RestTemplate(factory);
restTemplate = new RestTemplate();

form.add("client_id", clientId);
form.add("client_secret", clientSecret);
Expand Down
34 changes: 9 additions & 25 deletions ...onnect-client/src/main/java/org/mitre/openid/connect/client/OIDCAuthenticationFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,12 @@
import java.util.Map;
import java.util.UUID;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.apache.http.client.HttpClient;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.impl.client.HttpClientBuilder;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import jakarta.servlet.http.HttpSession;


import org.mitre.jwt.signer.service.JWTSigningAndValidationService;
import org.mitre.jwt.signer.service.impl.JWKSetCacheService;
import org.mitre.jwt.signer.service.impl.SymmetricKeyJWTValidatorCacheService;
Expand All @@ -58,7 +56,7 @@
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpMethod;
import org.springframework.http.client.ClientHttpRequest;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;

import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
Expand Down Expand Up @@ -120,9 +118,6 @@ public class OIDCAuthenticationFilter extends AbstractAuthenticationProcessingFi
@Autowired(required=false)
private JWTSigningAndValidationService authenticationSignerService;

@Autowired(required=false)
private HttpClient httpClient;

/*
* Modular services to build out client filter.
*/
Expand Down Expand Up @@ -344,22 +339,11 @@ protected Authentication handleAuthorizationCodeResponse(HttpServletRequest requ

// Handle Token Endpoint interaction

if(httpClient == null) {
httpClient = HttpClientBuilder.create()
.useSystemProperties()
.setDefaultRequestConfig(RequestConfig.custom()
.setSocketTimeout(httpSocketTimeout)
.build())
.build();
}

HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);

RestTemplate restTemplate;

if (SECRET_BASIC.equals(clientConfig.getTokenEndpointAuthMethod())){
// use BASIC auth if configured to do so
restTemplate = new RestTemplate(factory) {
restTemplate = new RestTemplate() {

@Override
protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOException {
Expand All @@ -374,7 +358,7 @@ protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOE
};
} else {
// we're not doing basic auth, figure out what other flavor we have
restTemplate = new RestTemplate(factory);
restTemplate = new RestTemplate();

if (SECRET_JWT.equals(clientConfig.getTokenEndpointAuthMethod()) || PRIVATE_KEY.equals(clientConfig.getTokenEndpointAuthMethod())) {
// do a symmetric secret signed JWT for auth
Expand Down
30 changes: 10 additions & 20 deletions openid-connect-client/src/main/java/org/mitre/openid/connect/client/UserInfoFetcher.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,7 @@
import java.util.concurrent.ExecutionException;
import java.util.concurrent.TimeUnit;

import org.apache.http.client.HttpClient;
import org.apache.http.client.utils.URIBuilder;
import org.apache.http.impl.client.HttpClientBuilder;

import org.mitre.openid.connect.config.ServerConfiguration;
import org.mitre.openid.connect.config.ServerConfiguration.UserInfoTokenMethod;
import org.mitre.openid.connect.model.DefaultUserInfo;
Expand All @@ -35,10 +33,11 @@
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpMethod;
import org.springframework.http.client.ClientHttpRequest;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;

import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import org.springframework.web.client.RestTemplate;
import org.springframework.web.util.UriComponentsBuilder;

import com.google.common.base.Strings;
import com.google.common.cache.CacheBuilder;
Expand All @@ -63,14 +62,10 @@ public class UserInfoFetcher {
private LoadingCache<PendingOIDCAuthenticationToken, UserInfo> cache;

public UserInfoFetcher() {
this(HttpClientBuilder.create().useSystemProperties().build());
}

public UserInfoFetcher(HttpClient httpClient) {
cache = CacheBuilder.newBuilder()
.expireAfterWrite(1, TimeUnit.HOURS) // expires 1 hour after fetch
.maximumSize(100)
.build(new UserInfoLoader(httpClient));
.build(new UserInfoLoader());
}

public UserInfo loadUserInfo(final PendingOIDCAuthenticationToken token) {
Expand All @@ -85,11 +80,6 @@ public UserInfo loadUserInfo(final PendingOIDCAuthenticationToken token) {


private class UserInfoLoader extends CacheLoader<PendingOIDCAuthenticationToken, UserInfo> {
private HttpComponentsClientHttpRequestFactory factory;

UserInfoLoader(HttpClient httpClient) {
this.factory = new HttpComponentsClientHttpRequestFactory(httpClient);
}

@Override
public UserInfo load(final PendingOIDCAuthenticationToken token) throws URISyntaxException {
Expand All @@ -109,7 +99,7 @@ public UserInfo load(final PendingOIDCAuthenticationToken token) throws URISynta
String userInfoString = null;

if (serverConfiguration.getUserInfoTokenMethod() == null || serverConfiguration.getUserInfoTokenMethod().equals(UserInfoTokenMethod.HEADER)) {
RestTemplate restTemplate = new RestTemplate(factory) {
RestTemplate restTemplate = new RestTemplate() {

@Override
protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOException {
Expand All @@ -125,14 +115,14 @@ protected ClientHttpRequest createRequest(URI url, HttpMethod method) throws IOE
MultiValueMap<String, String> form = new LinkedMultiValueMap<>();
form.add("access_token", token.getAccessTokenValue());

RestTemplate restTemplate = new RestTemplate(factory);
RestTemplate restTemplate = new RestTemplate();
userInfoString = restTemplate.postForObject(serverConfiguration.getUserInfoUri(), form, String.class);
} else if (serverConfiguration.getUserInfoTokenMethod().equals(UserInfoTokenMethod.QUERY)) {
URIBuilder builder = new URIBuilder(serverConfiguration.getUserInfoUri());
builder.setParameter("access_token", token.getAccessTokenValue());
UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(serverConfiguration.getUserInfoUri());
builder.queryParam("access_token", token.getAccessTokenValue());

RestTemplate restTemplate = new RestTemplate(factory);
userInfoString = restTemplate.getForObject(builder.toString(), String.class);
RestTemplate restTemplate = new RestTemplate();
userInfoString = restTemplate.getForObject(builder.build().toUriString(), String.class);
}


Expand Down
2 changes: 1 addition & 1 deletion ...ient/src/main/java/org/mitre/openid/connect/client/service/AuthRequestOptionsService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

import java.util.Map;

import javax.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequest;

import org.mitre.oauth2.model.RegisteredClient;
import org.mitre.openid.connect.config.ServerConfiguration;
Expand Down
2 changes: 1 addition & 1 deletion ...d-connect-client/src/main/java/org/mitre/openid/connect/client/service/IssuerService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
*/
package org.mitre.openid.connect.client.service;

import javax.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequest;

import org.mitre.openid.connect.client.model.IssuerServiceResponse;

Expand Down
20 changes: 2 additions & 18 deletions ...tre/openid/connect/client/service/impl/DynamicRegistrationClientConfigurationService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,6 @@
import java.util.Set;
import java.util.concurrent.ExecutionException;

import org.apache.http.client.HttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.mitre.oauth2.model.RegisteredClient;
import org.mitre.openid.connect.ClientDetailsEntityJsonProcessor;
import org.mitre.openid.connect.client.service.ClientConfigurationService;
Expand All @@ -37,7 +35,6 @@
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.http.MediaType;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.oauth2.common.OAuth2AccessToken;
import org.springframework.security.oauth2.common.exceptions.InvalidClientException;
Expand Down Expand Up @@ -73,11 +70,7 @@ public class DynamicRegistrationClientConfigurationService implements ClientConf
private Set<String> blacklist = new HashSet<>();

public DynamicRegistrationClientConfigurationService() {
this(HttpClientBuilder.create().useSystemProperties().build());
}

public DynamicRegistrationClientConfigurationService(HttpClient httpClient) {
clients = CacheBuilder.newBuilder().build(new DynamicClientRegistrationLoader(httpClient));
clients = CacheBuilder.newBuilder().build(new DynamicClientRegistrationLoader());
}

@Override
Expand Down Expand Up @@ -173,20 +166,11 @@ public void setBlacklist(Set<String> blacklist) {
*
*/
public class DynamicClientRegistrationLoader extends CacheLoader<ServerConfiguration, RegisteredClient> {
private HttpComponentsClientHttpRequestFactory httpFactory;
private Gson gson = new Gson(); // note that this doesn't serialize nulls by default

public DynamicClientRegistrationLoader() {
this(HttpClientBuilder.create().useSystemProperties().build());
}

public DynamicClientRegistrationLoader(HttpClient httpClient) {
this.httpFactory = new HttpComponentsClientHttpRequestFactory(httpClient);
}

@Override
public RegisteredClient load(ServerConfiguration serverConfig) throws Exception {
RestTemplate restTemplate = new RestTemplate(httpFactory);
RestTemplate restTemplate = new RestTemplate();


RegisteredClient knownClient = registeredClientService.getByIssuer(serverConfig.getIssuer());
Expand Down
17 changes: 5 additions & 12 deletions .../java/org/mitre/openid/connect/client/service/impl/DynamicServerConfigurationService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,13 +31,10 @@
import java.util.Set;
import java.util.concurrent.ExecutionException;

import org.apache.http.client.HttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.mitre.openid.connect.client.service.ServerConfigurationService;
import org.mitre.openid.connect.config.ServerConfiguration;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.web.client.RestTemplate;

Expand Down Expand Up @@ -70,12 +67,11 @@ public class DynamicServerConfigurationService implements ServerConfigurationSer
private Set<String> blacklist = new HashSet<>();

public DynamicServerConfigurationService() {
this(HttpClientBuilder.create().useSystemProperties().build());
servers = CacheBuilder.newBuilder().build(new OpenIDConnectServiceConfigurationFetcher());
}

public DynamicServerConfigurationService(HttpClient httpClient) {
// initialize the cache
servers = CacheBuilder.newBuilder().build(new OpenIDConnectServiceConfigurationFetcher(httpClient));
public DynamicServerConfigurationService(Object ignored) {
this();
}

/**
Expand Down Expand Up @@ -131,17 +127,14 @@ public ServerConfiguration getServerConfiguration(String issuer) {
*
*/
private class OpenIDConnectServiceConfigurationFetcher extends CacheLoader<String, ServerConfiguration> {
private HttpComponentsClientHttpRequestFactory httpFactory;
private RestTemplate restTemplate = new RestTemplate();
private JsonParser parser = new JsonParser();

OpenIDConnectServiceConfigurationFetcher(HttpClient httpClient) {
this.httpFactory = new HttpComponentsClientHttpRequestFactory(httpClient);
OpenIDConnectServiceConfigurationFetcher() {
}

@Override
public ServerConfiguration load(String issuer) throws Exception {
RestTemplate restTemplate = new RestTemplate(httpFactory);

// data holder
ServerConfiguration conf = new ServerConfiguration();

Expand Down
8 changes: 4 additions & 4 deletions ...ain/java/org/mitre/openid/connect/client/service/impl/EncryptedAuthRequestUrlBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
import java.util.Map;
import java.util.Map.Entry;

import org.apache.http.client.utils.URIBuilder;
import org.springframework.web.util.UriComponentsBuilder;
import org.mitre.jwt.encryption.service.JWTEncryptionAndDecryptionService;
import org.mitre.jwt.signer.service.impl.JWKSetCacheService;
import org.mitre.oauth2.model.RegisteredClient;
Expand Down Expand Up @@ -92,11 +92,11 @@ public String buildAuthRequestUrl(ServerConfiguration serverConfig, RegisteredCl
encryptor.encryptJwt(jwt);

try {
URIBuilder uriBuilder = new URIBuilder(serverConfig.getAuthorizationEndpointUri());
uriBuilder.addParameter("request", jwt.serialize());
UriComponentsBuilder uriBuilder = UriComponentsBuilder.fromUriString(serverConfig.getAuthorizationEndpointUri());
uriBuilder.queryParam("request", jwt.serialize());

// build out the URI
return uriBuilder.build().toString();
return uriBuilder.build().toUriString();
} catch (URISyntaxException e) {
throw new AuthenticationServiceException("Malformed Authorization Endpoint Uri", e);
}
Expand Down
2 changes: 1 addition & 1 deletion ...lient/src/main/java/org/mitre/openid/connect/client/service/impl/HybridIssuerService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@

import java.util.Set;

import javax.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletRequest;

import org.mitre.openid.connect.client.model.IssuerServiceResponse;
import org.mitre.openid.connect.client.service.IssuerService;
Expand Down
Loading