Skip to content

OAuth2AccessTokenInterceptor can handle Authentication Principal where principalName is null #1049

Closed
@agileknight

Description

@agileknight

Is your feature request related to a problem? Please describe.
When OAuth2AccessTokenInterceptor encounters an Authentication Principal where getName is null, it passes the null value on to the OAuth2AuthorizedClientManager, which in practice usually results in a runtime exception like principalName cannot be empty.

Describe the solution you'd like
The code already checks for a null principal an in that case passes ANONYMOUS_AUTHENTICATION. It appears to also make sense to pass ANONYMOUS_AUTHENTICATION for cases with a non-null principal but a null principal name.

Describe alternatives you've considered
Handling a null principal name downstream or upstream appears more complicated and it feels more natural to follow the current implementation of employing the ANONYMOUS_AUTHENTICATION placeholder for cases where the current authentication principal is not suitable.

Additional context
None

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions