-
Notifications
You must be signed in to change notification settings - Fork 6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Not all OAuth2 ClientAuthenticationMethods are supported in Jackson2 converters #16825
Labels
Comments
mapsu
added a commit
to mapsu/spring-security
that referenced
this issue
Mar 26, 2025
Closes spring-projectsgh-16825 Signed-off-by: Risto Virtanen <[email protected]>
mapsu
added a commit
to mapsu/spring-security
that referenced
this issue
Mar 26, 2025
Closes spring-projectsgh-16825 Signed-off-by: Risto Virtanen <[email protected]>
mapsu
added a commit
to mapsu/spring-security
that referenced
this issue
Mar 26, 2025
Closes spring-projectsgh-16825 Signed-off-by: Risto Virtanen <[email protected]>
mapsu
added a commit
to mapsu/spring-security
that referenced
this issue
Mar 26, 2025
Closes spring-projectsgh-16825 Signed-off-by: Risto Virtanen <[email protected]>
jzheaux
added a commit
that referenced
this issue
Apr 2, 2025
This commit adds a static factory for returning a constant ClientAuthenticationMethod or creating a new one when there is no match. Issue gh-16825
mapsu
added a commit
to mapsu/spring-security
that referenced
this issue
Apr 4, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Describe the bug
StdConverters do not support all available OAuth2 ClientAuthenticationMethods
https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/jackson2/StdConverters.java#L48-L65
For example
ClientAuthenticationMethod.PRIVATE_KEY_JWT
authentication method is missing from mapping.In case
private_key_jwt
is used for client authentication and authorized clients are stored in Redis then when loading and deserializing ClientRegistration from json theclientAuthenticationMethod
is not correctly converted and then later defaulted to incorrect value.Precondition
org.springframework.session:spring-session-data-redis
library to achieve thisTo Reproduce
Expected behavior
In token refresh, correct authentication method is used.
Sample
I decided to not include a sample this time because it would require setting up redis, e.g. in docker compose, but also authorization server for OAuth2 login.
The bug is quite obvious for me because there's missing ClientAuthenticationMethods missing from converter.
I can create a sample if you deem it's needed.
The text was updated successfully, but these errors were encountered: