Skip to content

Inconsistent ReactiveOAuth2UserService in OAuth2LoginSpec #15846

Closed
@blacelle

Description

@blacelle

Describe the bug
The way to configure a ReactiveOAuth2UserService<OAuth2UserRequest, OAuth2User> in OAuth2LoginSpec is inconsistent.

More specifically:

  • OAuth2LoginReactiveAuthenticationManager constructor is called over getOauth2UserService() which search for a bean of type ReactiveOAuth2UserService, else fallback on DefaultReactiveOAuth2UserService
  • OidcReactiveOAuth2UserService is instanciated by its default constructor, without relying on getOauth2UserService()
		private ReactiveAuthenticationManager createDefault() {
			[...]
			OAuth2LoginReactiveAuthenticationManager oauth2Manager = new OAuth2LoginReactiveAuthenticationManager(
					client, getOauth2UserService());
		private ReactiveOAuth2UserService<OidcUserRequest, OidcUser> getOidcUserService() {
			ResolvableType type = ResolvableType.forClassWithGenerics(ReactiveOAuth2UserService.class,
					OidcUserRequest.class, OidcUser.class);
			ReactiveOAuth2UserService<OidcUserRequest, OidcUser> bean = getBeanOrNull(type);
			if (bean != null) {
				return bean;
			}
			return new OidcReactiveOAuth2UserService();
		}

This leads to inconsistent ReactiveOAuth2UserService through the components created by OAuth2LoginSpec.

To Reproduce

@EnableWebFluxSecurity
@Import({

		CustomOAuth2UserService.class,

})
@Slf4j
@SpringBootApplication(scanBasePackages = "none")
public class InconsistentOAuth2UserDetailsServiceApp {
	public static class CustomOAuth2UserService extends DefaultOAuth2UserService {

	}

	@Bean
	public SecurityWebFilterChain configureUi(ServerHttpSecurity http) {

		return http.build();
	}

	public static void main(String[] args) {
		SpringApplication.run(InconsistentOAuth2UserDetailsServiceApp.class);
	}

}

Expected behavior
Given a bean of type ReactiveOAuth2UserService, it should be injected to all components needed one, especially OidcReactiveOAuth2UserService, as it is done for OAuth2LoginReactiveAuthenticationManager

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions