Merge branch 'Really_fixing_redirects'

openid-connect-server/src/main/java/org/mitre/openid/connect/token/JdbcUserApprovalHandler.java

@@ -0,0 +1,20 @@
+package org.mitre.openid.connect.token;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.provider.AuthorizationRequest;
+import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
+
+public class JdbcUserApprovalHandler implements UserApprovalHandler {
+
+	@Override
+	public boolean isApproved(AuthorizationRequest authorizationRequest,
+			Authentication userAuthentication) {
+		
+		//Check database to see if the user identified by the userAuthentication has stored an approval decision
+		userAuthentication.getPrincipal();
+		
+		
+		return false;
+	}
+
+}

openid-connect-server/src/main/webapp/WEB-INF/spring/appServlet/servlet-context.xml

@@ -55,7 +55,6 @@
 		token-services-ref="defaultOAuth2ProviderTokenService" token-granter-ref="connectAuthCodeTokenGranter"
 		user-approval-handler-ref="userApprovalHandler"
 		authorization-endpoint-url="/openidconnect/auth" token-endpoint-url="/openidconnect/token"
-		user-approval-page="redirect:/oauth/confirm_access"
 		>
 		<oauth:authorization-code authorization-code-services-ref="authCodeServices" />
 	</oauth:authorization-server>

openid-connect-server/src/main/webapp/WEB-INF/spring/application-context.xml

@@ -23,8 +23,7 @@
 
 	<security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="springSecurityAuthenticationManager"/>
 
-<!-- 4/11 AANGANES trying:remove "create-session="stateless"" from below statement -->
-	<http pattern="/oauth/token" authentication-manager-ref="clientAuthenticationManager" 
+	<security:http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager" 
 		xmlns="http://www.springframework.org/schema/security">
 		<intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
 		<anonymous enabled="false" />
@@ -32,7 +31,7 @@
 		<!-- include this only if you need to authenticate clients via request parameters -->
 		<custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" />
 		<access-denied-handler ref="oauthAccessDeniedHandler" />
-	</http>
+	</security:http>
 
 	<security:http use-expressions="true" auto-config="true" pattern="/oauth/authorize" authentication-manager-ref="springSecurityAuthenticationManager">
  		<security:intercept-url pattern="/oauth/authorize" access="hasRole('ROLE_USER')"/>