Extract Validation/Authentication Logic in AuthorizationCodeAuthenticationProcessingFilter

[rwinch]

Summary

There is quite a bit of logic in the AuthorizationCodeAuthenticationProcessingFilter which is considered validation or authentication. For example:

ErrorResponseAttributes authorizationError = this.errorResponseConverter.apply(request);
if (authorizationError != null) {
    OAuth2Error oauth2Error = new OAuth2Error(authorizationError.getErrorCode(),
    authorizationError.getDescription(), authorizationError.getUri());
    this.getAuthorizationRequestRepository().removeAuthorizationRequest(request);
    throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
}

if (!authorizationRequest.getState().equals(state)) {
    OAuth2Error oauth2Error = new OAuth2Error(INVALID_STATE_PARAMETER_ERROR_CODE);
    throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
}

if (!request.getRequestURL().toString().equals(authorizationRequest.getRedirectUri())) {
     OAuth2Error oauth2Error = new OAuth2Error(INVALID_REDIRECT_URI_PARAMETER_ERROR_CODE);
     throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
}

We should try to provide a richer Authentication object to the AuthenticationManager and allow it to validate the response entirely.