Skip to content

Not all OAuth2 ClientAuthenticationMethods are supported in Jackson2 converters #16825

Closed
@mapsu

Description

@mapsu

Describe the bug
StdConverters do not support all available OAuth2 ClientAuthenticationMethods
https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/jackson2/StdConverters.java#L48-L65

For example ClientAuthenticationMethod.PRIVATE_KEY_JWT authentication method is missing from mapping.
In case private_key_jwt is used for client authentication and authorized clients are stored in Redis then when loading and deserializing ClientRegistration from json the clientAuthenticationMethod is not correctly converted and then later defaulted to incorrect value.

Precondition

  • Project using Spring Security configured to store session data to Redis
    • Use org.springframework.session:spring-session-data-redis library to achieve this
  • Store OAuth2 authorised clients to Http Session instead of InMemory
    • Configure OAuth2AuthorizedClientRepository to HttpSessionOAuth2AuthorizedClientRepository

To Reproduce

  • Authenticate with a user
    • The authorized client is stored to Redis with client registration details
  • When access token expires and OAuth2AuthorizedManager tries to refresh token then incorrect authentication method is used

Expected behavior
In token refresh, correct authentication method is used.

Sample
I decided to not include a sample this time because it would require setting up redis, e.g. in docker compose, but also authorization server for OAuth2 login.
The bug is quite obvious for me because there's missing ClientAuthenticationMethods missing from converter.

I can create a sample if you deem it's needed.

Metadata

Metadata

Assignees

Labels

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)status: duplicateA duplicate of another issuetype: bugA general bug

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions