Use ClientAuthenticationMethod constants tls_client_auth and self_signed_tls_client_auth

Issue spring-projectsgh-1558, spring-projectsgh-1559, spring-projectsgh-1560

Author: jgrandja

Diff for: oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/X509ClientCertificateAuthenticationProvider.java

@@ -50,10 +50,6 @@
  */
 public final class X509ClientCertificateAuthenticationProvider implements AuthenticationProvider {
 	private static final String ERROR_URI = "https://datatracker.ietf.org/doc/html/rfc6749#section-3.2.1";
-	private static final ClientAuthenticationMethod TLS_CLIENT_AUTH_AUTHENTICATION_METHOD =
-			new ClientAuthenticationMethod("tls_client_auth");
-	private static final ClientAuthenticationMethod SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD =
-			new ClientAuthenticationMethod("self_signed_tls_client_auth");
 	private final Log logger = LogFactory.getLog(getClass());
 	private final RegisteredClientRepository registeredClientRepository;
 	private final CodeVerifierAuthenticator codeVerifierAuthenticator;
@@ -80,8 +76,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
 		OAuth2ClientAuthenticationToken clientAuthentication =
 				(OAuth2ClientAuthenticationToken) authentication;
 
-		if (!TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod()) &&
-				!SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod())) {
+		if (!ClientAuthenticationMethod.TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod()) &&
+				!ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod())) {
 			return null;
 		}
 
@@ -148,7 +144,7 @@ public void setCertificateVerifier(Consumer<OAuth2ClientAuthenticationContext> c
 
 	private void verifyX509Certificate(OAuth2ClientAuthenticationContext clientAuthenticationContext) {
 		OAuth2ClientAuthenticationToken clientAuthentication = clientAuthenticationContext.getAuthentication();
-		if (SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod())) {
+		if (ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod())) {
 			this.selfSignedCertificateVerifier.accept(clientAuthenticationContext);
 		} else {
 			verifyX509CertificateSubjectDN(clientAuthenticationContext);

Diff for: oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcProviderConfigurationEndpointFilter.java

@@ -129,8 +129,8 @@ private static Consumer<List<String>> clientAuthenticationMethods() {
 			authenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue());
 			authenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_JWT.getValue());
 			authenticationMethods.add(ClientAuthenticationMethod.PRIVATE_KEY_JWT.getValue());
-			authenticationMethods.add("tls_client_auth");
-			authenticationMethods.add("self_signed_tls_client_auth");
+			authenticationMethods.add(ClientAuthenticationMethod.TLS_CLIENT_AUTH.getValue());
+			authenticationMethods.add(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.getValue());
 		};
 	}
 

Diff for: oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/token/DefaultOAuth2TokenClaimsConsumer.java

@@ -34,10 +34,6 @@
  * @since 1.3
  */
 final class DefaultOAuth2TokenClaimsConsumer implements Consumer<Map<String, Object>> {
-	private static final ClientAuthenticationMethod TLS_CLIENT_AUTH_AUTHENTICATION_METHOD =
-			new ClientAuthenticationMethod("tls_client_auth");
-	private static final ClientAuthenticationMethod SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD =
-			new ClientAuthenticationMethod("self_signed_tls_client_auth");
 	private final OAuth2TokenContext context;
 
 	DefaultOAuth2TokenClaimsConsumer(OAuth2TokenContext context) {
@@ -51,8 +47,8 @@ public void accept(Map<String, Object> claims) {
 				this.context.getAuthorizationGrant() != null &&
 				this.context.getAuthorizationGrant().getPrincipal() instanceof OAuth2ClientAuthenticationToken clientAuthentication) {
 
-			if ((TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod()) ||
-					SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD.equals(clientAuthentication.getClientAuthenticationMethod())) &&
+			if ((ClientAuthenticationMethod.TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod()) ||
+					ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.equals(clientAuthentication.getClientAuthenticationMethod())) &&
 					this.context.getRegisteredClient().getTokenSettings().isX509CertificateBoundAccessTokens()) {
 
 				X509Certificate[] clientCertificateChain = (X509Certificate[]) clientAuthentication.getCredentials();

Diff for: oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/OAuth2AuthorizationServerMetadataEndpointFilter.java

@@ -122,8 +122,8 @@ private static Consumer<List<String>> clientAuthenticationMethods() {
 			authenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_POST.getValue());
 			authenticationMethods.add(ClientAuthenticationMethod.CLIENT_SECRET_JWT.getValue());
 			authenticationMethods.add(ClientAuthenticationMethod.PRIVATE_KEY_JWT.getValue());
-			authenticationMethods.add("tls_client_auth");
-			authenticationMethods.add("self_signed_tls_client_auth");
+			authenticationMethods.add(ClientAuthenticationMethod.TLS_CLIENT_AUTH.getValue());
+			authenticationMethods.add(ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH.getValue());
 		};
 	}
 

Diff for: oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/X509ClientCertificateAuthenticationConverter.java

@@ -44,10 +44,6 @@
  * @see OAuth2ClientAuthenticationFilter
  */
 public final class X509ClientCertificateAuthenticationConverter implements AuthenticationConverter {
-	private static final ClientAuthenticationMethod TLS_CLIENT_AUTH_AUTHENTICATION_METHOD =
-			new ClientAuthenticationMethod("tls_client_auth");
-	private static final ClientAuthenticationMethod SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD =
-			new ClientAuthenticationMethod("self_signed_tls_client_auth");
 
 	@Nullable
 	@Override
@@ -72,8 +68,8 @@ public Authentication convert(HttpServletRequest request) {
 
 		ClientAuthenticationMethod clientAuthenticationMethod =
 				clientCertificateChain.length == 1 ?
-						SELF_SIGNED_TLS_CLIENT_AUTH_AUTHENTICATION_METHOD :
-						TLS_CLIENT_AUTH_AUTHENTICATION_METHOD;
+						ClientAuthenticationMethod.SELF_SIGNED_TLS_CLIENT_AUTH :
+						ClientAuthenticationMethod.TLS_CLIENT_AUTH;
 
 		return new OAuth2ClientAuthenticationToken(clientId, clientAuthenticationMethod,
 				clientCertificateChain, additionalParameters);