The following issues were found

samples/boot/oauth2-integration/authorizationserver/src/main/java/sample/jose/KeyGeneratorUtils.java
11 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 41 

              	static SecretKey generateSecretKey() {
		SecretKey hmacKey;
		try {
			hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return hmacKey;
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 42 

              		SecretKey hmacKey;
		try {
			hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return hmacKey;
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 52 

              		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 53 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 54 

              			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 78 

              		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 79 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 80 

              			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}
}

Reported by PMD.

Found 'DU'-anomaly for variable 'hmacKey' (lines '41'-'46').
Error

Line: 41 

              	static SecretKey generateSecretKey() {
		SecretKey hmacKey;
		try {
			hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return hmacKey;
	}

Reported by PMD.

Found 'DU'-anomaly for variable 'keyPair' (lines '53'-'58').
Error

Line: 53 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2RefreshTokenAuthenticationConverter.java
11 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 55 

              	public Authentication convert(HttpServletRequest request) {
		// grant_type (REQUIRED)
		String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
		if (!AuthorizationGrantType.REFRESH_TOKEN.getValue().equals(grantType)) {
			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

Reported by PMD.

Potential violation of Law of Demeter (static property access)
Design

Line: 55 

              	public Authentication convert(HttpServletRequest request) {
		// grant_type (REQUIRED)
		String grantType = request.getParameter(OAuth2ParameterNames.GRANT_TYPE);
		if (!AuthorizationGrantType.REFRESH_TOKEN.getValue().equals(grantType)) {
			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 59 

              			return null;
		}

		Authentication clientPrincipal = SecurityContextHolder.getContext().getAuthentication();

		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// refresh_token (REQUIRED)
		String refreshToken = parameters.getFirst(OAuth2ParameterNames.REFRESH_TOKEN);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 64 

              		MultiValueMap<String, String> parameters = OAuth2EndpointUtils.getParameters(request);

		// refresh_token (REQUIRED)
		String refreshToken = parameters.getFirst(OAuth2ParameterNames.REFRESH_TOKEN);
		if (!StringUtils.hasText(refreshToken) ||
				parameters.get(OAuth2ParameterNames.REFRESH_TOKEN).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.REFRESH_TOKEN,

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 66 

              		// refresh_token (REQUIRED)
		String refreshToken = parameters.getFirst(OAuth2ParameterNames.REFRESH_TOKEN);
		if (!StringUtils.hasText(refreshToken) ||
				parameters.get(OAuth2ParameterNames.REFRESH_TOKEN).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.REFRESH_TOKEN,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 66 

              		// refresh_token (REQUIRED)
		String refreshToken = parameters.getFirst(OAuth2ParameterNames.REFRESH_TOKEN);
		if (!StringUtils.hasText(refreshToken) ||
				parameters.get(OAuth2ParameterNames.REFRESH_TOKEN).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.REFRESH_TOKEN,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 74 

              		}

		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
		if (StringUtils.hasText(scope) &&
				parameters.get(OAuth2ParameterNames.SCOPE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.SCOPE,

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 76 

              		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
		if (StringUtils.hasText(scope) &&
				parameters.get(OAuth2ParameterNames.SCOPE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.SCOPE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 76 

              		// scope (OPTIONAL)
		String scope = parameters.getFirst(OAuth2ParameterNames.SCOPE);
		if (StringUtils.hasText(scope) &&
				parameters.get(OAuth2ParameterNames.SCOPE).size() != 1) {
			OAuth2EndpointUtils.throwError(
					OAuth2ErrorCodes.INVALID_REQUEST,
					OAuth2ParameterNames.SCOPE,
					OAuth2EndpointUtils.ACCESS_TOKEN_REQUEST_ERROR_URI);
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 89 

              		}

		Map<String, Object> additionalParameters = new HashMap<>();
		parameters.forEach((key, value) -> {
			if (!key.equals(OAuth2ParameterNames.GRANT_TYPE) &&
					!key.equals(OAuth2ParameterNames.REFRESH_TOKEN) &&
					!key.equals(OAuth2ParameterNames.SCOPE)) {
				additionalParameters.put(key, value.get(0));
			}

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerMetadataTests.java
11 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 62 

              	private static JWKSource<SecurityContext> jwkSource;

	@Rule
	public final SpringTestRule spring = new SpringTestRule();

	@Autowired
	private MockMvc mvc;

	@Autowired

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 65 

              	public final SpringTestRule spring = new SpringTestRule();

	@Autowired
	private MockMvc mvc;

	@Autowired
	private JdbcOperations jdbcOperations;

	@BeforeClass

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 68 

              	private MockMvc mvc;

	@Autowired
	private JdbcOperations jdbcOperations;

	@BeforeClass
	public static void setupClass() {
		JWKSet jwkSet = new JWKSet(TestJwks.DEFAULT_RSA_JWK);
		jwkSource = (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);

Reported by PMD.

A method/constructor should not explicitly throw java.lang.Exception
Design

Line: 95 

              	}

	@Test
	public void requestWhenAuthorizationServerMetadataRequestAndIssuerSetThenReturnMetadataResponse() throws Exception {
		this.spring.register(AuthorizationServerConfiguration.class).autowire();

		this.mvc.perform(get(DEFAULT_OAUTH2_AUTHORIZATION_SERVER_METADATA_ENDPOINT_URI))
				.andExpect(status().is2xxSuccessful())
				.andExpect(jsonPath("issuer").value(issuerUrl))

Reported by PMD.

JUnit tests should include assert() or fail()
Design

Line: 95 

              	}

	@Test
	public void requestWhenAuthorizationServerMetadataRequestAndIssuerSetThenReturnMetadataResponse() throws Exception {
		this.spring.register(AuthorizationServerConfiguration.class).autowire();

		this.mvc.perform(get(DEFAULT_OAUTH2_AUTHORIZATION_SERVER_METADATA_ENDPOINT_URI))
				.andExpect(status().is2xxSuccessful())
				.andExpect(jsonPath("issuer").value(issuerUrl))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 99 

              		this.spring.register(AuthorizationServerConfiguration.class).autowire();

		this.mvc.perform(get(DEFAULT_OAUTH2_AUTHORIZATION_SERVER_METADATA_ENDPOINT_URI))
				.andExpect(status().is2xxSuccessful())
				.andExpect(jsonPath("issuer").value(issuerUrl))
				.andReturn();
	}

	@EnableWebSecurity

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 100 

              
		this.mvc.perform(get(DEFAULT_OAUTH2_AUTHORIZATION_SERVER_METADATA_ENDPOINT_URI))
				.andExpect(status().is2xxSuccessful())
				.andExpect(jsonPath("issuer").value(issuerUrl))
				.andReturn();
	}

	@EnableWebSecurity
	@Import(OAuth2AuthorizationServerConfiguration.class)

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 110 

              
		@Bean
		RegisteredClientRepository registeredClientRepository(JdbcOperations jdbcOperations) {
			RegisteredClient registeredClient = TestRegisteredClients.registeredClient().build();
			JdbcRegisteredClientRepository registeredClientRepository = new JdbcRegisteredClientRepository(jdbcOperations);
			registeredClientRepository.save(registeredClient);
			return registeredClientRepository;
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 128 

              
		@Bean
		ProviderSettings providerSettings() {
			return ProviderSettings.builder().issuer(issuerUrl).build();
		}
	}

}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 128 

              
		@Bean
		ProviderSettings providerSettings() {
			return ProviderSettings.builder().issuer(issuerUrl).build();
		}
	}

}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/OidcClientRegistrationEndpointFilter.java
11 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 60 

              	 */
	private static final String DEFAULT_OIDC_CLIENT_REGISTRATION_ENDPOINT_URI = "/connect/register";

	private final AuthenticationManager authenticationManager;
	private final RequestMatcher clientRegistrationEndpointMatcher;
	private final HttpMessageConverter<OidcClientRegistration> clientRegistrationHttpMessageConverter =
			new OidcClientRegistrationHttpMessageConverter();
	private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
			new OAuth2ErrorHttpMessageConverter();

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 61 

              	private static final String DEFAULT_OIDC_CLIENT_REGISTRATION_ENDPOINT_URI = "/connect/register";

	private final AuthenticationManager authenticationManager;
	private final RequestMatcher clientRegistrationEndpointMatcher;
	private final HttpMessageConverter<OidcClientRegistration> clientRegistrationHttpMessageConverter =
			new OidcClientRegistrationHttpMessageConverter();
	private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
			new OAuth2ErrorHttpMessageConverter();

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 62 

              
	private final AuthenticationManager authenticationManager;
	private final RequestMatcher clientRegistrationEndpointMatcher;
	private final HttpMessageConverter<OidcClientRegistration> clientRegistrationHttpMessageConverter =
			new OidcClientRegistrationHttpMessageConverter();
	private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
			new OAuth2ErrorHttpMessageConverter();

	/**

Reported by PMD.

Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 64 

              	private final RequestMatcher clientRegistrationEndpointMatcher;
	private final HttpMessageConverter<OidcClientRegistration> clientRegistrationHttpMessageConverter =
			new OidcClientRegistrationHttpMessageConverter();
	private final HttpMessageConverter<OAuth2Error> errorHttpResponseConverter =
			new OAuth2ErrorHttpMessageConverter();

	/**
	 * Constructs an {@code OidcClientRegistrationEndpointFilter} using the provided parameters.
	 *

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 101 

              		}

		try {
			Authentication principal = SecurityContextHolder.getContext().getAuthentication();
			OidcClientRegistration clientRegistration = this.clientRegistrationHttpMessageConverter.read(
					OidcClientRegistration.class, new ServletServerHttpRequest(request));

			OidcClientRegistrationAuthenticationToken clientRegistrationAuthentication =
					new OidcClientRegistrationAuthenticationToken(principal, clientRegistration);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 111 

              			OidcClientRegistrationAuthenticationToken clientRegistrationAuthenticationResult =
					(OidcClientRegistrationAuthenticationToken) this.authenticationManager.authenticate(clientRegistrationAuthentication);

			sendClientRegistrationResponse(response, clientRegistrationAuthenticationResult.getClientRegistration());

		} catch (OAuth2AuthenticationException ex) {
			sendErrorResponse(response, ex.getError());
		} catch (Exception ex) {
			OAuth2Error error = new OAuth2Error(

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 115 

              
		} catch (OAuth2AuthenticationException ex) {
			sendErrorResponse(response, ex.getError());
		} catch (Exception ex) {
			OAuth2Error error = new OAuth2Error(
					OAuth2ErrorCodes.INVALID_REQUEST,
					"OpenID Client Registration Error: " + ex.getMessage(),
					"https://openid.net/specs/openid-connect-registration-1_0.html#RegistrationError");
			sendErrorResponse(response, error);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 134 

              
	private void sendErrorResponse(HttpServletResponse response, OAuth2Error error) throws IOException {
		HttpStatus httpStatus = HttpStatus.BAD_REQUEST;
		if (error.getErrorCode().equals(OAuth2ErrorCodes.INVALID_TOKEN)) {
			httpStatus = HttpStatus.UNAUTHORIZED;
		} else if (error.getErrorCode().equals(OAuth2ErrorCodes.INSUFFICIENT_SCOPE)) {
			httpStatus = HttpStatus.FORBIDDEN;
		}
		ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 136 

              		HttpStatus httpStatus = HttpStatus.BAD_REQUEST;
		if (error.getErrorCode().equals(OAuth2ErrorCodes.INVALID_TOKEN)) {
			httpStatus = HttpStatus.UNAUTHORIZED;
		} else if (error.getErrorCode().equals(OAuth2ErrorCodes.INSUFFICIENT_SCOPE)) {
			httpStatus = HttpStatus.FORBIDDEN;
		}
		ServletServerHttpResponse httpResponse = new ServletServerHttpResponse(response);
		httpResponse.setStatusCode(httpStatus);
		this.errorHttpResponseConverter.write(error, null, httpResponse);

Reported by PMD.

Found 'DD'-anomaly for variable 'httpStatus' (lines '133'-'135').
Error

Line: 133 

              	}

	private void sendErrorResponse(HttpServletResponse response, OAuth2Error error) throws IOException {
		HttpStatus httpStatus = HttpStatus.BAD_REQUEST;
		if (error.getErrorCode().equals(OAuth2ErrorCodes.INVALID_TOKEN)) {
			httpStatus = HttpStatus.UNAUTHORIZED;
		} else if (error.getErrorCode().equals(OAuth2ErrorCodes.INSUFFICIENT_SCOPE)) {
			httpStatus = HttpStatus.FORBIDDEN;
		}

Reported by PMD.

samples/boot/oauth2-integration/authorizationserver-custom-consent-page/src/main/java/sample/jose/KeyGeneratorUtils.java
11 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 40 

              	static SecretKey generateSecretKey() {
		SecretKey hmacKey;
		try {
			hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return hmacKey;
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 41 

              		SecretKey hmacKey;
		try {
			hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return hmacKey;
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 51 

              		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 52 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 53 

              			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 77 

              		KeyPair keyPair;
		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 78 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

Avoid catching generic exceptions such as NullPointerException, RuntimeException, Exception in try-catch block
Design

Line: 79 

              			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
			keyPairGenerator.initialize(ecParameterSpec);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}
}

Reported by PMD.

Found 'DU'-anomaly for variable 'hmacKey' (lines '40'-'45').
Error

Line: 40 

              	static SecretKey generateSecretKey() {
		SecretKey hmacKey;
		try {
			hmacKey = KeyGenerator.getInstance("HmacSha256").generateKey();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return hmacKey;
	}

Reported by PMD.

Found 'DU'-anomaly for variable 'keyPair' (lines '52'-'57').
Error

Line: 52 

              		try {
			KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
			keyPairGenerator.initialize(2048);
			keyPair = keyPairGenerator.generateKeyPair();
		} catch (Exception ex) {
			throw new IllegalStateException(ex);
		}
		return keyPair;
	}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/OidcClientMetadataClaimNames.java
11 issues
Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 34 

              	/**
	 * {@code client_id} - the Client Identifier
	 */
	String CLIENT_ID = "client_id";

	/**
	 * {@code client_id_issued_at} - the time at which the Client Identifier was issued
	 */
	String CLIENT_ID_ISSUED_AT = "client_id_issued_at";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 39 

              	/**
	 * {@code client_id_issued_at} - the time at which the Client Identifier was issued
	 */
	String CLIENT_ID_ISSUED_AT = "client_id_issued_at";

	/**
	 * {@code client_secret} - the Client Secret
	 */
	String CLIENT_SECRET = "client_secret";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 44 

              	/**
	 * {@code client_secret} - the Client Secret
	 */
	String CLIENT_SECRET = "client_secret";

	/**
	 * {@code client_secret_expires_at} - the time at which the {@code client_secret} will expire or 0 if it will not expire
	 */
	String CLIENT_SECRET_EXPIRES_AT = "client_secret_expires_at";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 49 

              	/**
	 * {@code client_secret_expires_at} - the time at which the {@code client_secret} will expire or 0 if it will not expire
	 */
	String CLIENT_SECRET_EXPIRES_AT = "client_secret_expires_at";

	/**
	 * {@code client_name} - the name of the Client to be presented to the End-User
	 */
	String CLIENT_NAME = "client_name";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 54 

              	/**
	 * {@code client_name} - the name of the Client to be presented to the End-User
	 */
	String CLIENT_NAME = "client_name";

	/**
	 * {@code redirect_uris} - the redirection {@code URI} values used by the Client
	 */
	String REDIRECT_URIS = "redirect_uris";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 59 

              	/**
	 * {@code redirect_uris} - the redirection {@code URI} values used by the Client
	 */
	String REDIRECT_URIS = "redirect_uris";

	/**
	 * {@code token_endpoint_auth_method} - the authentication method used by the Client for the Token Endpoint
	 */
	String TOKEN_ENDPOINT_AUTH_METHOD = "token_endpoint_auth_method";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 64 

              	/**
	 * {@code token_endpoint_auth_method} - the authentication method used by the Client for the Token Endpoint
	 */
	String TOKEN_ENDPOINT_AUTH_METHOD = "token_endpoint_auth_method";

	/**
	 * {@code grant_types} - the OAuth 2.0 {@code grant_type} values that the Client will restrict itself to using
	 */
	String GRANT_TYPES = "grant_types";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 69 

              	/**
	 * {@code grant_types} - the OAuth 2.0 {@code grant_type} values that the Client will restrict itself to using
	 */
	String GRANT_TYPES = "grant_types";

	/**
	 * {@code response_types} - the OAuth 2.0 {@code response_type} values that the Client will restrict itself to using
	 */
	String RESPONSE_TYPES = "response_types";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 74 

              	/**
	 * {@code response_types} - the OAuth 2.0 {@code response_type} values that the Client will restrict itself to using
	 */
	String RESPONSE_TYPES = "response_types";

	/**
	 * {@code scope} - a space-separated list of OAuth 2.0 {@code scope} values that the Client will restrict itself to using
	 */
	String SCOPE = "scope";

Reported by PMD.

Avoid constants in interfaces. Interfaces define types, constants are implementation details better placed in classes or enums. See Effective Java, item 19.
Design

Line: 79 

              	/**
	 * {@code scope} - a space-separated list of OAuth 2.0 {@code scope} values that the Client will restrict itself to using
	 */
	String SCOPE = "scope";

	/**
	 * {@code id_token_signed_response_alg} - the {@link JwsAlgorithm JWS} algorithm required for signing the {@link OidcIdToken ID Token} issued to the Client
	 */
	String ID_TOKEN_SIGNED_RESPONSE_ALG = "id_token_signed_response_alg";

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/core/oidc/OidcProviderConfiguration.java
11 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 140 

              		@Override
		protected void validate() {
			super.validate();
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.JWKS_URI), "jwksUri cannot be null");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be empty");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms must be of type List");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 141 

              		protected void validate() {
			super.validate();
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.JWKS_URI), "jwksUri cannot be null");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be empty");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be empty");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 142 

              			super.validate();
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.JWKS_URI), "jwksUri cannot be null");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be empty");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be empty");
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 143 

              			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.JWKS_URI), "jwksUri cannot be null");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be empty");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be empty");
		}

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 144 

              			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be empty");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be empty");
		}

		@SuppressWarnings("unchecked")

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 145 

              			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be empty");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be empty");
		}

		@SuppressWarnings("unchecked")
		private void addClaimToClaimList(String name, String value) {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 146 

              			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.SUBJECT_TYPES_SUPPORTED), "subjectTypes cannot be empty");
			Assert.notNull(getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be null");
			Assert.isInstanceOf(List.class, getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms must be of type List");
			Assert.notEmpty((List<?>) getClaims().get(OidcProviderMetadataClaimNames.ID_TOKEN_SIGNING_ALG_VALUES_SUPPORTED), "idTokenSigningAlgorithms cannot be empty");
		}

		@SuppressWarnings("unchecked")
		private void addClaimToClaimList(String name, String value) {
			Assert.hasText(name, "name cannot be empty");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 153 

              		private void addClaimToClaimList(String name, String value) {
			Assert.hasText(name, "name cannot be empty");
			Assert.notNull(value, "value cannot be null");
			getClaims().computeIfAbsent(name, k -> new LinkedList<String>());
			((List<String>) getClaims().get(name)).add(value);
		}

		@SuppressWarnings("unchecked")
		private void acceptClaimValues(String name, Consumer<List<String>> valuesConsumer) {

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 154 

              			Assert.hasText(name, "name cannot be empty");
			Assert.notNull(value, "value cannot be null");
			getClaims().computeIfAbsent(name, k -> new LinkedList<String>());
			((List<String>) getClaims().get(name)).add(value);
		}

		@SuppressWarnings("unchecked")
		private void acceptClaimValues(String name, Consumer<List<String>> valuesConsumer) {
			Assert.hasText(name, "name cannot be empty");

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 161 

              		private void acceptClaimValues(String name, Consumer<List<String>> valuesConsumer) {
			Assert.hasText(name, "name cannot be empty");
			Assert.notNull(valuesConsumer, "valuesConsumer cannot be null");
			getClaims().computeIfAbsent(name, k -> new LinkedList<String>());
			List<String> values = (List<String>) getClaims().get(name);
			valuesConsumer.accept(values);
		}

	}

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenRevocationAuthenticationProvider.java
11 issues
Found non-transient, non-static member. Please mark as transient or provide accessors.
Error

Line: 42 

               * @see <a target="_blank" href="https://tools.ietf.org/html/rfc7009#section-2.1">Section 2.1 Revocation Request</a>
 */
public final class OAuth2TokenRevocationAuthenticationProvider implements AuthenticationProvider {
	private final OAuth2AuthorizationService authorizationService;

	/**
	 * Constructs an {@code OAuth2TokenRevocationAuthenticationProvider} using the provided parameters.
	 *
	 * @param authorizationService the authorization service

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 61 

              
		OAuth2ClientAuthenticationToken clientPrincipal =
				getAuthenticatedClientElseThrowInvalidClient(tokenRevocationAuthentication);
		RegisteredClient registeredClient = clientPrincipal.getRegisteredClient();

		OAuth2Authorization authorization = this.authorizationService.findByToken(
				tokenRevocationAuthentication.getToken(), null);
		if (authorization == null) {
			// Return the authentication request when token not found

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 64 

              		RegisteredClient registeredClient = clientPrincipal.getRegisteredClient();

		OAuth2Authorization authorization = this.authorizationService.findByToken(
				tokenRevocationAuthentication.getToken(), null);
		if (authorization == null) {
			// Return the authentication request when token not found
			return tokenRevocationAuthentication;
		}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 70 

              			return tokenRevocationAuthentication;
		}

		if (!registeredClient.getId().equals(authorization.getRegisteredClientId())) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_CLIENT);
		}

		OAuth2Authorization.Token<AbstractOAuth2Token> token = authorization.getToken(tokenRevocationAuthentication.getToken());
		authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, token.getToken());

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 70 

              			return tokenRevocationAuthentication;
		}

		if (!registeredClient.getId().equals(authorization.getRegisteredClientId())) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_CLIENT);
		}

		OAuth2Authorization.Token<AbstractOAuth2Token> token = authorization.getToken(tokenRevocationAuthentication.getToken());
		authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, token.getToken());

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 70 

              			return tokenRevocationAuthentication;
		}

		if (!registeredClient.getId().equals(authorization.getRegisteredClientId())) {
			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_CLIENT);
		}

		OAuth2Authorization.Token<AbstractOAuth2Token> token = authorization.getToken(tokenRevocationAuthentication.getToken());
		authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, token.getToken());

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 74 

              			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_CLIENT);
		}

		OAuth2Authorization.Token<AbstractOAuth2Token> token = authorization.getToken(tokenRevocationAuthentication.getToken());
		authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, token.getToken());
		this.authorizationService.save(authorization);

		return new OAuth2TokenRevocationAuthenticationToken(token.getToken(), clientPrincipal);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 74 

              			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_CLIENT);
		}

		OAuth2Authorization.Token<AbstractOAuth2Token> token = authorization.getToken(tokenRevocationAuthentication.getToken());
		authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, token.getToken());
		this.authorizationService.save(authorization);

		return new OAuth2TokenRevocationAuthenticationToken(token.getToken(), clientPrincipal);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 75 

              		}

		OAuth2Authorization.Token<AbstractOAuth2Token> token = authorization.getToken(tokenRevocationAuthentication.getToken());
		authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, token.getToken());
		this.authorizationService.save(authorization);

		return new OAuth2TokenRevocationAuthenticationToken(token.getToken(), clientPrincipal);
	}

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 78 

              		authorization = OAuth2AuthenticationProviderUtils.invalidate(authorization, token.getToken());
		this.authorizationService.save(authorization);

		return new OAuth2TokenRevocationAuthenticationToken(token.getToken(), clientPrincipal);
	}

	@Override
	public boolean supports(Class<?> authentication) {
		return OAuth2TokenRevocationAuthenticationToken.class.isAssignableFrom(authentication);

Reported by PMD.

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/JwtUtils.java
11 issues
Potential violation of Law of Demeter (object not created locally)
Design

Line: 53 

              			String issuer, String subject, Set<String> authorizedScopes) {

		Instant issuedAt = Instant.now();
		Instant expiresAt = issuedAt.plus(registeredClient.getTokenSettings().getAccessTokenTimeToLive());

		// @formatter:off
		JwtClaimsSet.Builder claimsBuilder = JwtClaimsSet.builder();
		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 53 

              			String issuer, String subject, Set<String> authorizedScopes) {

		Instant issuedAt = Instant.now();
		Instant expiresAt = issuedAt.plus(registeredClient.getTokenSettings().getAccessTokenTimeToLive());

		// @formatter:off
		JwtClaimsSet.Builder claimsBuilder = JwtClaimsSet.builder();
		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);
		}
		claimsBuilder
				.subject(subject)
				.audience(Collections.singletonList(registeredClient.getClientId()))
				.issuedAt(issuedAt)
				.expiresAt(expiresAt)
				.notBefore(issuedAt);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);
		}
		claimsBuilder
				.subject(subject)
				.audience(Collections.singletonList(registeredClient.getClientId()))
				.issuedAt(issuedAt)
				.expiresAt(expiresAt)
				.notBefore(issuedAt);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);
		}
		claimsBuilder
				.subject(subject)
				.audience(Collections.singletonList(registeredClient.getClientId()))
				.issuedAt(issuedAt)
				.expiresAt(expiresAt)
				.notBefore(issuedAt);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 60 

              		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);
		}
		claimsBuilder
				.subject(subject)
				.audience(Collections.singletonList(registeredClient.getClientId()))
				.issuedAt(issuedAt)
				.expiresAt(expiresAt)
				.notBefore(issuedAt);

Reported by PMD.

Potential violation of Law of Demeter (object not created locally)
Design

Line: 79 

              
		Instant issuedAt = Instant.now();
		// TODO Allow configuration for ID Token time-to-live
		Instant expiresAt = issuedAt.plus(30, ChronoUnit.MINUTES);

		// @formatter:off
		JwtClaimsSet.Builder claimsBuilder = JwtClaimsSet.builder();
		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 86 

              		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);
		}
		claimsBuilder
				.subject(subject)
				.audience(Collections.singletonList(registeredClient.getClientId()))
				.issuedAt(issuedAt)
				.expiresAt(expiresAt)
				.claim(IdTokenClaimNames.AZP, registeredClient.getClientId());

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 86 

              		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);
		}
		claimsBuilder
				.subject(subject)
				.audience(Collections.singletonList(registeredClient.getClientId()))
				.issuedAt(issuedAt)
				.expiresAt(expiresAt)
				.claim(IdTokenClaimNames.AZP, registeredClient.getClientId());

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 86 

              		if (StringUtils.hasText(issuer)) {
			claimsBuilder.issuer(issuer);
		}
		claimsBuilder
				.subject(subject)
				.audience(Collections.singletonList(registeredClient.getClientId()))
				.issuedAt(issuedAt)
				.expiresAt(expiresAt)
				.claim(IdTokenClaimNames.AZP, registeredClient.getClientId());

Reported by PMD.

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/jwt/TestJoseHeaders.java
10 issues
Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.

Potential violation of Law of Demeter (method chain calls)
Design

Line: 38 

              
	public static JoseHeader.Builder joseHeader(SignatureAlgorithm signatureAlgorithm) {
		// @formatter:off
		return JoseHeader.withAlgorithm(signatureAlgorithm)
				.jwkSetUrl("https://provider.com/oauth2/jwks")
				.jwk(rsaJwk())
				.keyId("keyId")
				.x509Url("https://provider.com/oauth2/x509")
				.x509CertificateChain(Arrays.asList("x509Cert1", "x509Cert2"))

Reported by PMD.