import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Override
protected OAuth2Authentication getOAuth2Authentication(ClientDetails client, TokenRequest tokenRequest) {

    Map<String, String> parameters = tokenRequest.getRequestParameters();
    String authorizationCode = parameters.get("code");
    String redirectUri = parameters.get(OAuth2Utils.REDIRECT_URI);
    String codeVerifier = parameters.get("code_verifier");

    if (authorizationCode == null) {
        throw new InvalidRequestException("An authorization code must be supplied.");
    }

    OAuth2Authentication storedAuth = authorizationCodeServices.consumeAuthorizationCode(authorizationCode);
    if (storedAuth == null) {
        throw new InvalidGrantException("Invalid authorization code: " + authorizationCode);
    }

    OAuth2Request pendingOAuth2Request = storedAuth.getOAuth2Request();




    // Validates code verifier
    Map<String, String> pendingOauth2RequestParams = pendingOAuth2Request.getRequestParameters();
    String codeChallenge = pendingOauth2RequestParams.get("code_challenge");
    String codeChallengeMethod = pendingOauth2RequestParams.get("code_challenge_method");

    if (codeVerifier == null && codeChallenge != null) {
        // client is using PKCE but did not send the codeVerifier
        throw new InvalidRequestException(
                "Invalid authorization code for current token request.");
    }

    if (codeVerifier != null && codeChallenge != null) {
        String hashed = codeVerifier;
        if ("S256".equals(codeChallengeMethod)) {
            hashed = DigestUtils.sha256Hex(codeVerifier);
        }

        if (!hashed.equalsIgnoreCase(codeChallenge)) {
            throw new InvalidRequestException(
                    "Invalid authorization code for current token request.");
        }
    }



    // https://jira.springsource.org/browse/SECOAUTH-333
    // This might be null, if the authorization was done without the redirect_uri parameter
    String redirectUriApprovalParameter = pendingOAuth2Request.getRequestParameters().get(
            OAuth2Utils.REDIRECT_URI);

    if ((redirectUri != null || redirectUriApprovalParameter != null)
            && !pendingOAuth2Request.getRedirectUri().equals(redirectUri)) {
        throw new RedirectMismatchException("Redirect URI mismatch.");
    }

    String pendingClientId = pendingOAuth2Request.getClientId();
    String clientId = tokenRequest.getClientId();
    if (clientId != null && !clientId.equals(pendingClientId)) {
        // just a sanity check.
        throw new InvalidClientException("Client ID mismatch");
    }

    // Secret is not required in the authorization request, so it won't be available
    // in the pendingAuthorizationRequest. We do want to check that a secret is provided
    // in the token request, but that happens elsewhere.

    Map<String, String> combinedParameters = new HashMap<String, String>(pendingOAuth2Request
            .getRequestParameters());
    // Combine the parameters adding the new ones last so they override if there are any clashes
    combinedParameters.putAll(parameters);

    // Make a new stored request with the combined parameters
    OAuth2Request finalStoredOAuth2Request = pendingOAuth2Request.createOAuth2Request(combinedParameters);

    Authentication userAuth = storedAuth.getUserAuthentication();

    return new OAuth2Authentication(finalStoredOAuth2Request, userAuth);

}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
private BaseClientDetails createOrUpdateClient(final BaseClientDetails client) {

        MultiValueMap<String, String> headers = new LinkedMultiValueMap<>();
        headers.add("Accept", MediaType.APPLICATION_JSON_VALUE);
        headers.add("Content-Type", MediaType.APPLICATION_JSON_VALUE);
        HttpEntity<String> postEntity = new HttpEntity<>(JSON_UTILS.serialize(client), headers);

        ResponseEntity<String> clientCreate = null;
        try {
            clientCreate = this.uaaAdminTemplate.exchange(this.uaaUrl + "/oauth/clients", HttpMethod.POST, postEntity,
                    String.class);
            if (clientCreate.getStatusCode() == HttpStatus.CREATED) {
                return JSON_UTILS.deserialize(clientCreate.getBody(), BaseClientDetails.class);
            } else {
                throw new RuntimeException("Unexpected return code for client create: " + clientCreate.getStatusCode());
            }
        } catch (InvalidClientException ex) {
            if (ex.getMessage().equals("Client already exists: " + client.getClientId())) {
                HttpEntity<String> putEntity = new HttpEntity<String>(JSON_UTILS.serialize(client), headers);
                ResponseEntity<String> clientUpdate = this.uaaAdminTemplate.exchange(
                        this.uaaUrl + "/oauth/clients/" + client.getClientId(), HttpMethod.PUT, putEntity,
                        String.class);
                if (clientUpdate.getStatusCode() == HttpStatus.OK) {
                    return JSON_UTILS.deserialize(clientUpdate.getBody(), BaseClientDetails.class);
                } else {
                    throw new RuntimeException(
                            "Unexpected return code for client update: " + clientUpdate.getStatusCode());
                }
            }
        }
        throw new RuntimeException("Unexpected return code for client creation: " + clientCreate.getStatusCode());
    }
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Override
public Authentication extractAuthentication(final Map<String, ?> authenticationAttributes) {
  if (!authenticationAttributes.containsKey(UNSPECIFIED_ID) &&
    authenticationAttributes.containsKey(CLIENT_ID)) {
    return new ClientCredentialsAuthentication((String) authenticationAttributes.get(CLIENT_ID), DEFAULT_AUTHORITIES);
  } else if (authenticationAttributes.containsKey(UNSPECIFIED_ID) &&
    authenticationAttributes.containsKey(SCHAC_HOME_KEY)) {
    return new SchacHomeAuthentication((String) authenticationAttributes.get(SCHAC_HOME_KEY),
      authenticationAttributes.get(UNSPECIFIED_ID), "N/A", DEFAULT_AUTHORITIES);
  }
  throw new InvalidClientException(String.format("Unsupported client authentication. Must contain either %s or %s and %s",
    CLIENT_ID, UNSPECIFIED_ID, SCHAC_HOME_KEY));
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
public ClientDetails loadClientByClientId(String clientId) throws InvalidClientException {
    DBObject query = new BasicDBObject(clientIdFieldName, clientId);
    DBObject entry = getClientDetailsCollection().findOne(query);
    if (entry == null) {
        throw new NoSuchClientException("No client with requested id: " + clientId);
    }
    return toClientDetails(entry);
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
protected void validateGrantType(String grantType, ClientDetails clientDetails) {
	Collection<String> authorizedGrantTypes = clientDetails.getAuthorizedGrantTypes();
	if (authorizedGrantTypes != null && !authorizedGrantTypes.isEmpty()
			&& !authorizedGrantTypes.contains(grantType)) {
		throw new InvalidClientException("Unauthorized grant type: " + grantType);
	}
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
public ClientDetails loadClientByClientId(String clientId) throws InvalidClientException {
	ClientDetails details;
	try {
		details = jdbcTemplate.queryForObject(selectClientDetailsSql, new ClientDetailsRowMapper(), clientId);
	}
	catch (EmptyResultDataAccessException e) {
		throw new NoSuchClientException("No client with requested id: " + clientId);
	}

	return details;
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
public TokenRequest createTokenRequest(Map<String, String> requestParameters, ClientDetails authenticatedClient) {

		String clientId = requestParameters.get(OAuth2Utils.CLIENT_ID);
		if (clientId == null) {
			// if the clientId wasn't passed in in the map, we add pull it from the authenticated client object
			clientId = authenticatedClient.getClientId();
		} else {
			// otherwise, make sure that they match
			if (!clientId.equals(authenticatedClient.getClientId())) {
				throw new InvalidClientException("Given client ID does not match authenticated client");
			}
		}
		Set<String> scopes = OAuth2Utils.parseParameterList(requestParameters.get(OAuth2Utils.SCOPE));
		String grantType = requestParameters.get(OAuth2Utils.GRANT_TYPE);
		
		ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId);

		if ((scopes == null || scopes.isEmpty())) {
			// If no scopes are specified in the incoming data, use the default values registered with the client
			// (the spec allows us to choose between this option and rejecting the request completely, so we'll take the
			// least obnoxious choice as a default).
			scopes = clientDetails.getScope();
		}

		TokenRequest tokenRequest = new TokenRequest(requestParameters, clientId, scopes, grantType);
		
		return tokenRequest;
	}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void writeInvalidClient() throws IOException {
	OAuth2Exception oauthException = new InvalidClientException(DETAILS);
	String expected = createResponse(oauthException.getOAuth2ErrorCode());
	converter.write(oauthException, contentType, outputMessage);
	assertEquals(expected, getOutput());
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void readInvalidClient() throws IOException {
	String accessToken = createResponse(OAuth2Exception.INVALID_CLIENT);
	when(inputMessage.getBody()).thenReturn(createInputStream(accessToken));
	@SuppressWarnings("unused")
	InvalidClientException result = (InvalidClientException) converter.read(InvalidClientException.class,
			inputMessage);
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void testCommenceWithOAuth2Exception() throws Exception {
	request.addHeader("Accept", MediaType.APPLICATION_JSON_VALUE);
	entryPoint.commence(request, response, new BadCredentialsException("Bad", new InvalidClientException(
			"Bad client")));
	assertEquals(HttpServletResponse.SC_UNAUTHORIZED, response.getStatus());
	assertEquals("{\"error\":\"invalid_client\",\"error_description\":\"Bad client\"}", response.getContentAsString());
	assertEquals(MediaType.APPLICATION_JSON_VALUE, response.getContentType());
	assertEquals(null, response.getErrorMessage());
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test(expected = InvalidClientException.class)
public void testGrantTypeNotSupported() {
	ResourceOwnerPasswordTokenGranter granter = new ResourceOwnerPasswordTokenGranter(
			authenticationManager, providerTokenServices,
			clientDetailsService, requestFactory);
	client.setAuthorizedGrantTypes(Collections
			.singleton("client_credentials"));
	granter.grant("password", tokenRequest);
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void testErrorPage() throws Exception {
	request.setContextPath("/foo");
	request.setAttribute("error", new InvalidClientException("FOO"));
	ModelAndView result = endpoint.handleError(request);
	result.getView().render(result.getModel(), request , response);
	String content = response.getContentAsString();
	assertTrue("Wrong content: " + content, content.contains("OAuth Error"));
	assertTrue("Wrong content: " + content, content.contains("invalid_client"));
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void readValueInvalidClient() throws Exception {
	String accessToken = createResponse(OAuth2Exception.INVALID_CLIENT);
	InvalidClientException result = (InvalidClientException) mapper.readValue(accessToken, OAuth2Exception.class);
	assertEquals(DETAILS,result.getMessage());
	assertEquals(null,result.getAdditionalInformation());
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void readValueWithAdditionalDetails() throws Exception {
	String accessToken = "{\"error\": \"invalid_client\", \"error_description\": \"some detail\", \"foo\": \"bar\"}";
	InvalidClientException result = (InvalidClientException) mapper.readValue(accessToken, OAuth2Exception.class);
	assertEquals(DETAILS,result.getMessage());
	assertEquals("{foo=bar}",result.getAdditionalInformation().toString());
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void writeValueAsStringWithAdditionalDetails() throws Exception {
	oauthException = new InvalidClientException(DETAILS);
	oauthException.addAdditionalInformation("foo", "bar");
	String expected = "{\"error\":\"invalid_client\",\"error_description\":\"some detail\",\"foo\":\"bar\"}";
	assertEquals(expected,mapper.writeValueAsString(oauthException));
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void testExceptionDeserialization() throws Exception {
	Map<String, String> exception = MapBuilder.create("error", "invalid_client").add("error_description", "FOO")
			.build();
	OAuth2Exception result = OAuth2Exception.valueOf(exception);
	// System.err.println(result);
	assertEquals("FOO", result.getMessage());
	assertEquals("invalid_client", result.getOAuth2ErrorCode());
	assertTrue(result instanceof InvalidClientException);
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void testExceptionSerialization() throws Exception {
	InvalidClientException exception = new InvalidClientException("FOO");
	exception.addAdditionalInformation("foo", "bar");
	String result = new ObjectMapper().writeValueAsString(exception);
	// System.err.println(result);
	assertTrue("Wrong result: "+result, result.contains("\"error\":\"invalid_client\""));
	assertTrue("Wrong result: "+result, result.contains("\"error_description\":\"FOO\""));
	assertTrue("Wrong result: "+result, result.contains("\"foo\":\"bar\""));
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
@Test
public void testExceptionDeserialization() throws Exception {
	String exception = "{\"error\": \"invalid_client\", \"error_description\": \"FOO\", \"foo\": \"bar\"}";
	OAuth2Exception result = new ObjectMapper().readValue(exception, OAuth2Exception.class);
	// System.err.println(result);
	assertEquals("FOO", result.getMessage());
	assertEquals("invalid_client", result.getOAuth2ErrorCode());
	assertEquals("{foo=bar}", result.getAdditionalInformation().toString());
	assertTrue(result instanceof InvalidClientException);
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
/** Returns the configured endpoint URI to retrieve the public key. */
private String getPublicKeyEndpoint() {
    String tokenEndpointUrl = oAuth2Properties.getSignatureVerification().getPublicKeyEndpointUri();
    if (tokenEndpointUrl == null) {
        throw new InvalidClientException("no token endpoint configured in application properties");
    }
    return tokenEndpointUrl;
}
 

import org.springframework.security.oauth2.common.exceptions.InvalidClientException; //导入依赖的package包/类
protected String getClientSecret() {
    String clientSecret = oAuth2Properties.getWebClientConfiguration().getSecret();
    if(clientSecret == null) {
        throw new InvalidClientException("no client-secret configured in application properties");
    }
    return clientSecret;
}