Create an approved site when using device code flow

iam-login-service/src/main/java/it/infn/mw/iam/IamLoginService.java

@@ -17,6 +17,7 @@
 
 import org.mitre.discovery.web.DiscoveryEndpoint;
 import org.mitre.oauth2.web.CorsFilter;
+import org.mitre.oauth2.web.DeviceEndpoint;
 import org.mitre.oauth2.web.OAuthConfirmationController;
 import org.mitre.openid.connect.web.DynamicClientRegistrationEndpoint;
 import org.mitre.openid.connect.web.JWKSetPublishingEndpoint;
@@ -77,7 +78,9 @@
     @ComponentScan.Filter(type=FilterType.ASSIGNABLE_TYPE,
         value=CorsFilter.class),
     @ComponentScan.Filter(type=FilterType.ASSIGNABLE_TYPE,
-        value=OAuthConfirmationController.class)
+        value=OAuthConfirmationController.class),
+    @ComponentScan.Filter(type=FilterType.ASSIGNABLE_TYPE,
+        value=DeviceEndpoint.class)
 })
 @EnableCaching
 @EnableAutoConfiguration(

iam-login-service/src/main/java/it/infn/mw/iam/config/IamConfig.java

@@ -47,6 +47,7 @@
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.oauth2.provider.ClientDetailsService;
+import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
 import org.springframework.security.oauth2.provider.code.AuthorizationCodeServices;
 import org.springframework.security.oauth2.provider.token.TokenEnhancer;
 
@@ -55,6 +56,7 @@
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.authn.ExternalAuthenticationInfoProcessor;
 import it.infn.mw.iam.core.oauth.IamIntrospectionResultAssembler;
+import it.infn.mw.iam.core.oauth.IamUserApprovalHandler;
 import it.infn.mw.iam.core.oauth.attributes.AttributeMapHelper;
 import it.infn.mw.iam.core.oauth.profile.IamTokenEnhancer;
 import it.infn.mw.iam.core.oauth.profile.JWTProfile;
@@ -307,6 +309,11 @@ ServletRegistrationBean<WebServlet> h2Console() {
   UsernameValidator usernameRegExpValidator() {
     return new UsernameValidator();
   }
+
+  @Bean
+  UserApprovalHandler iamUserApprovalHandler() {
+    return new IamUserApprovalHandler();
+  }
 
   @Bean(destroyMethod = "shutdown")
   public ScheduledExecutorService taskScheduler() {

iam-login-service/src/main/java/it/infn/mw/iam/config/MitreServicesConfig.java

@@ -59,7 +59,6 @@
 import org.mitre.openid.connect.service.impl.MatchLoginHintsAgainstUsers;
 import org.mitre.openid.connect.service.impl.UUIDPairwiseIdentiferService;
 import org.mitre.openid.connect.token.ConnectTokenEnhancer;
-import org.mitre.openid.connect.token.TofuUserApprovalHandler;
 import org.mitre.openid.connect.web.AuthenticationTimeStamper;
 import org.mitre.openid.connect.web.ServerConfigInterceptor;
 import org.mitre.uma.service.ResourceSetService;
@@ -70,7 +69,6 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.oauth2.provider.OAuth2RequestFactory;
 import org.springframework.security.oauth2.provider.OAuth2RequestValidator;
-import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
 import org.springframework.security.oauth2.provider.endpoint.RedirectResolver;
 import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
 import org.springframework.security.oauth2.provider.token.TokenEnhancer;
@@ -129,8 +127,9 @@ public ConfigurationPropertiesBean config(IamProperties properties) {
 
     config.setForceHttps(false);
     config.setLocale(Locale.ENGLISH);
-
-    config.setAllowCompleteDeviceCodeUri(properties.getDeviceCode().getAllowCompleteVerificationUri());
+
+    config
+      .setAllowCompleteDeviceCodeUri(properties.getDeviceCode().getAllowCompleteVerificationUri());
 
     return config;
   }
@@ -162,12 +161,6 @@ OAuth2RequestValidator requestValidator(ScopeMatcherRegistry registry) {
     return new ScopeMatcherOAuthRequestValidator(registry);
   }
 
-  @Bean
-  UserApprovalHandler tofuApprovalHandler() {
-
-    return new TofuUserApprovalHandler();
-  }
-
   @Bean
   OAuth2RequestFactory requestFactory(IamScopeFilter scopeFilter,
       JWTProfileResolver profileResolver) {
@@ -203,8 +196,7 @@ public ServerConfigInterceptor serverConfigInterceptor() {
   public FilterRegistrationBean<AuthorizationRequestFilter> disabledMitreFilterRegistration(
       AuthorizationRequestFilter f) {
 
-    FilterRegistrationBean<AuthorizationRequestFilter> b =
-        new FilterRegistrationBean<>(f);
+    FilterRegistrationBean<AuthorizationRequestFilter> b = new FilterRegistrationBean<>(f);
     b.setEnabled(false);
     return b;
   }