Bump spring-xsuaa from 2.13.7 to 3.0.1

[dependabot]

Bumps spring-xsuaa from 2.13.7 to 3.0.1.

Release notes

Sourced from spring-xsuaa's releases.

Version 3.0.0

Baseline changes

cloud-security-services-integration-library requires

• Java 17
• Spring Boot 3.0.x
• Spring security 6.0.x

Breaking Changes

• Identity service configurations need to provide domains via String array in JSON key 'identity.credentials.domains'. Providing String values under key 'identity.credentials.domain' is not supported anymore. IAS configurations from service bindings have been generated like this for a long time already. This should only affect old configuration files manually written for testing.

Removed modules

• spring-xsuaa-mock → use java-security-test instead

Removed deprecated classes and interfaces

• [api]
  • XSPrincipal, XSUserInfoException → not needed anymore with new Token interface
• [env]
  • CFEnvironment, K8sEnvironment → use instead ServiceBindingEnvironment
  • CFConstants, K8sConstants → use instead ServiceConstants
• [java-security]
  • XSUserInfo, XSUserInfoAdapter → use instead Token interface and Token#getClaimAsString with TokenClaims.XSUAA constants to access XSUAA-specific claims.
  • SAPOfflineTokenServicesCloud → use instead [spring-security] module
• [spring-xsuaa]
  • XSTokenRequest, TokenBroker, UaaTokenBroker → use instead token-client module to fetch XSUAA tokens via XsuaaTokenFlows
  • TokenBrokerResolver, AuthenticaionMethod → No longer provided. See spring-security-basic-auth sample how to write your own implementation.
  • IasXsuaaExchangeBroker → Exchange is not supported by XSUAA service anymore.
  • TokenUrlUtils → use instead OAuth2ServiceEndpointsProvider
  • XsuaaServicesParser → use instead Environments#getCurrent or new ServiceBindingEnvironment(new SapVcapServicesServiceBindingAccessor(any -> xsuaaConfigJson))
  • OAuth2AuthenticationConverter → Not supported anymore because deprecated by Spring Security: https://github.com/spring-projects/spring-security/wiki/OAuth-2.0-Migration-Guide
• [token-client]
  • UserTokenFlow → use instead JwtBearerTokenFlow

Removed deprecated methods

• [java-security]
  • OAuth2TokenKeyServiceWithCache#withCacheTime, OAuth2TokenKeyServiceWithCache#withCacheSize → use instead OAuth2TokenKeyServiceWithCache#withCacheConfiguration
  • SAPOfflineTokenServicesCloud#SAPOfflineTokenServicesCloud(OAuth2ServiceConfiguration) →
• [java-security-test]
  • SecurityTestRule#getConfigurationBuilderFromFile → use instead SecurityTestRule#getOAuth2ServiceConfigurationBuilderFromFile
  • SecurityTestRule#getWireMockRule → use instead SecurityTestRule#getWireMockServer
• [spring-xsuaa]
  • Token#getExpirationDate → use instead Token#getExpiration
• [spring-xsuaa-test]
  • Base64JwtDecoder#Base64JwtDecoder → use instead Base64JwtDecoder#getInstance
• [token-client]
  • XsuaaTokenFlows#userTokenFlow → use instead XsuaaTokenFlows#jwtBearerTokenFlow
  • OAuth2TokenService#retrieveAccessTokenViaUserTokenGrant → use instead OAuth2TokenService#retrieveAccessTokenViaJwtBearerTokenGrant
  • OAuth2TokenService#retrieveAccessTokenViaClientCredentialsGrant(URI, ClientIdentity, String, Map, boolean) → use instead OAuth2TokenService#retrieveAccessTokenViaClientCredentialsGrant with null for argument subdomain
  • DefaultOAuth2TokenService#DefaultOAuth2TokenService → use instead DefaultOAuth2TokenService#DefaultOAuth2TokenService(CloseableHttpClient)
  • XsuaaOAuth2TokenService#XsuaaOAuth2TokenService → use instead XsuaaOAuth2TokenService#XsuaaOAuth2TokenService(CloseableHttpClient)
  • DefaultOAuth2TokenService#DefaultOAuth2TokenService(TokenCacheConfiguration) → use instead DefaultOAuth2TokenService#DefaultOAuth2TokenService(CloseableHttpClient, TokenCacheConfiguration)

... (truncated)

Changelog

Sourced from spring-xsuaa's changelog.

3.0.1

• [spring-xsuaa] fixes incompatible TLS version for DefaultSpringHttpClientFactory

Dependency upgrades

• Bump spring.core.version from 6.0.8 to 6.0.9
• Bump reactor-core from 3.5.5 to 3.5.6
• Bump btp-environment-variable-access from 0.5.2 to 0.6.0

3.0.0

Baseline changes

cloud-security-services-integration-library requires

• Java 17
• Spring Boot 3.0.x
• Spring security 6.0.x

Breaking Changes

• Identity service configurations need to provide domains via String array in JSON key 'identity.credentials.domains'. Providing String values under key 'identity.credentials.domain' is not supported anymore. IAS configurations from service bindings have been generated like this for a long time already. This should only affect old configuration files manually written for testing.

Removed modules

• spring-xsuaa-mock → use java-security-test instead

Removed deprecated classes and interfaces

• [api]
  • XSPrincipal, XSUserInfoException → not needed anymore with new Token interface
• [env]
  • CFEnvironment, K8sEnvironment → use instead ServiceBindingEnvironment
  • CFConstants, K8sConstants → use instead ServiceConstants
• [java-security]
  • XSUserInfo, XSUserInfoAdapter → use instead Token interface and Token#getClaimAsString with TokenClaims.XSUAA constants to access XSUAA-specific claims.
  • SAPOfflineTokenServicesCloud → use instead [spring-security] module
• [spring-xsuaa]
  • XSTokenRequest, TokenBroker, UaaTokenBroker → use instead token-client module to fetch XSUAA tokens via XsuaaTokenFlows
  • TokenBrokerResolver, AuthenticaionMethod → No longer provided. See spring-security-basic-auth sample how to write your own implementation.
  • IasXsuaaExchangeBroker → Exchange is not supported by XSUAA service anymore.
  • TokenUrlUtils → use instead OAuth2ServiceEndpointsProvider
  • XsuaaServicesParser → use instead Environments#getCurrent or new ServiceBindingEnvironment(new SapVcapServicesServiceBindingAccessor(any -> xsuaaConfigJson))
  • OAuth2AuthenticationConverter → Not supported anymore because deprecated by Spring Security: https://github.com/spring-projects/spring-security/wiki/OAuth-2.0-Migration-Guide
• [token-client]
  • UserTokenFlow → use instead JwtBearerTokenFlow

Removed deprecated methods

• [java-security]
  • OAuth2TokenKeyServiceWithCache#withCacheTime, OAuth2TokenKeyServiceWithCache#withCacheSize → use instead OAuth2TokenKeyServiceWithCache#withCacheConfiguration
  • SAPOfflineTokenServicesCloud#SAPOfflineTokenServicesCloud(OAuth2ServiceConfiguration) →
• [java-security-test]
  • SecurityTestRule#getConfigurationBuilderFromFile → use instead SecurityTestRule#getOAuth2ServiceConfigurationBuilderFromFile
  • SecurityTestRule#getWireMockRule → use instead SecurityTestRule#getWireMockServer
• [spring-xsuaa]
  • Token#getExpirationDate → use instead Token#getExpiration
• [spring-xsuaa-test]

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)