Not all OAuth2 ClientAuthenticationMethods are supported in Jackson2 converters #16825
Labels
in: oauth2
An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)
status: duplicate
A duplicate of another issue
type: bug
A general bug
Describe the bug
StdConverters do not support all available OAuth2 ClientAuthenticationMethods
https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/jackson2/StdConverters.java#L48-L65
For example
ClientAuthenticationMethod.PRIVATE_KEY_JWT
authentication method is missing from mapping.In case
private_key_jwt
is used for client authentication and authorized clients are stored in Redis then when loading and deserializing ClientRegistration from json theclientAuthenticationMethod
is not correctly converted and then later defaulted to incorrect value.Precondition
org.springframework.session:spring-session-data-redis
library to achieve thisTo Reproduce
Expected behavior
In token refresh, correct authentication method is used.
Sample
I decided to not include a sample this time because it would require setting up redis, e.g. in docker compose, but also authorization server for OAuth2 login.
The bug is quite obvious for me because there's missing ClientAuthenticationMethods missing from converter.
I can create a sample if you deem it's needed.
The text was updated successfully, but these errors were encountered: