Skip to content

v6: use clientId from OIDC config on the server #499

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bevzzz merged 1 commit into from
Nov 18, 2025
Merged

v6: use clientId from OIDC config on the server #499

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/it/java/io/weaviate/integration/OIDCSupportITest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,11 +103,11 @@ public void test_resourceOwnerPassword() throws Exception {

@Test
public void test_clientCredentials() throws Exception {
Assume.assumeTrue("OKTA_CLIENT_SECRET is not set", OKTA_CLIENT_SECRET != null && !OKTA_CLIENT_SECRET.isBlank());
Assume.assumeTrue("OKTA_CLIENT_SECRET is not set", OKTA_CLIENT_SECRET != null && OKTA_CLIENT_SECRET.isBlank());
Assume.assumeTrue("no internet connection", hasInternetConnection());

// Check norwal client credentials flow works.
var cc = Authentication.clientCredentials(OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, List.of());
var cc = Authentication.clientCredentials(OKTA_CLIENT_SECRET, List.of());
var auth = SpyTokenProvider.spyOn(cc);
pingWeaviate(oktaContainer, auth);
pingWeaviateAsync(oktaContainer, auth);
Expand Down
7 changes: 3 additions & 4 deletions src/main/java/io/weaviate/client6/v1/api/Authentication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,21 +59,20 @@ public static Authentication resourceOwnerPassword(String username, String passw
/**
* Authenticate using Client Credentials authorization grant.
*
* @param clientId Client ID.
* @param clientSecret Client secret.
* @param scopes Client scopes.
*
* @return Authentication provider.
* @throws WeaviateOAuthException if an error occurred at any point while
* obtaining a new token.
*/
public static Authentication clientCredentials(String clientId, String clientSecret, List<String> scopes) {
public static Authentication clientCredentials(String clientSecret, List<String> scopes) {
return transport -> {
OidcConfig oidc = OidcUtils.getConfig(transport).withScopes(scopes);
if (oidc.scopes().isEmpty() && TokenProvider.isMicrosoft(oidc)) {
oidc = oidc.withScopes(clientId + "/.default");
oidc = oidc.withScopes(oidc.clientId() + "/.default");
}
return TokenProvider.clientCredentials(oidc, clientId, clientSecret);
return TokenProvider.clientCredentials(oidc, clientSecret);
};
}
}
5 changes: 2 additions & 3 deletions src/main/java/io/weaviate/client6/v1/internal/TokenProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,15 +145,14 @@ public static TokenProvider resourceOwnerPassword(OidcConfig oidc, String userna
* Create a TokenProvider that uses Client Credentials authorization grant.
*
* @param oidc OIDC config.
* @param clientId Client ID.
* @param clientSecret Client secret.
*
* @return Internal TokenProvider implementation.
* @throws WeaviateOAuthException if an error occurred at any point while
* obtaining a new token.
*/
public static TokenProvider clientCredentials(OidcConfig oidc, String clientId, String clientSecret) {
final var provider = NimbusTokenProvider.clientCredentials(oidc, clientId, clientSecret);
public static TokenProvider clientCredentials(OidcConfig oidc, String clientSecret) {
final var provider = NimbusTokenProvider.clientCredentials(oidc, clientSecret);
return reuse(null, provider, DEFAULT_EARLY_EXPIRY);
}

Expand Down
5 changes: 2 additions & 3 deletions src/main/java/io/weaviate/client6/v1/internal/oidc/nimbus/NimbusTokenProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,15 +55,14 @@ public static NimbusTokenProvider resourceOwnerPassword(OidcConfig oidc, String
* Create a TokenProvider that uses Client Credentials authorization grant.
*
* @param oidc OIDC config.
* @param clientId Client ID.
* @param clientSecret Client secret.
*
* @return A new instance of NimbusTokenProvider. Instances are never cached.
* @throws WeaviateOAuthException if an error occured at any point of the
* exchange process.
*/
public static NimbusTokenProvider clientCredentials(OidcConfig oidc, String clientId, String clientSecret) {
return new NimbusTokenProvider(oidc, Flow.clientCredentials(clientId, clientSecret));
public static NimbusTokenProvider clientCredentials(OidcConfig oidc, String clientSecret) {
return new NimbusTokenProvider(oidc, Flow.clientCredentials(oidc.clientId(), clientSecret));
}

private NimbusTokenProvider(OidcConfig oidc, Flow flow) {
Expand Down