spring-authorization-server: OAuth2ClientAuthenticationToken should not be persisted across requests

@jgrandja @colin-riddell

I believe what @colin-riddell is referring to (since we discussed this together offline) is a custom scenario using a different authentication mechanism other than form login, for example using JWT authentication. In this case, it seems possible that JwtAuthenticationToken would be placed in the java.security.Principal attribute as it is actually the principal representing the user’s authentication.

Our mixin inherits from Spring Security the ability to persist a UsernamePasswordAuthenticationToken into attributes. But in case of a different authentication, there would still be the need for an application to provide their own mixins to ensure the OAuth2Authorization can be persisted via JSON in the database. I feel this would be another example where a How-to guide could capture how this can be customized, and potentially such a mixin (that Colin has already developed a draft of) could be part of that guide.

Hope that helps.

Great, thank you @jgrandja and @sjohnr! The temporary fix works perfectly.

add Annotation com.fasterxml.jackson.databind.annotation.JsonSerialize

Is this something you want more info on in a separate issue @sjohnr - if it’s something the core team believes would be useful to be able to serialize, am happy to contribute that mixin.

Hi @colin-riddell. Since that is not something that’s happening out of the box (e.g. in the existing sample), probably not at this time. However, it may be required in the future. As a current example, when using the UserInfo endpoint you need to enable oauth2ResourceServer().jwt(). So it’s very close to a core requirement, but not enabled out-of-the-box as of yet.

Thanks for the feedback. I opened #507 with code working in my project, but it may contain unnecessary mixins which the core team don’t want. Once I have your guidance I’ll improve the code and get this done. Thanks!

Awesome. Thanks for the heads up! I will review it as soon as I can and get back to you with that feedback.

Our mixin inherits from Spring Security the ability to persist a UsernamePasswordAuthenticationToken into attributes. But in case of a different authentication, there would still be the need for an application to provide their own mixins to ensure the OAuth2Authorization can be persisted via JSON in the database. I feel this would be another example where a How-to guide could capture how this can be customized, and potentially such a mixin (that Colin has already developed a draft of) could be part of that guide.

@sjohnr I just encoutered the issue when deserializing OAuth2ClientAuthenticationToken. I am implemententing a custom grant type (the password grant type) but when I try to refresh the token I get this error:

The class with org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken and name of org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken is not in the allowlist.

The issue comes from OAuth2RefreshTokenAuthenticationProvider where we have to provide authorization’s attribute. To provide one I registered it like this:

@Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          ...
        OAuth2ClientAuthenticationToken clientPrincipal = OAuth2AuthenticationProviderUtils.getAuthenticatedClientElseThrowInvalidClient((Authentication) passwordGrantAuthenticationToken.getPrincipal());
        ...
        OAuth2Authorization authorization = OAuth2Authorization.withRegisteredClient(registeredClient)
                .principalName(userDetails.getUsername())
                .authorizedScopes(authorizedScopes)
                .authorizationGrantType(PASSWORD_GRANT_TYPE)
                .attribute(Principal.class.getName(), clientPrincipal) //===== here
                .token(accessToken, (metadata) -> metadata.put(OAuth2Authorization.Token.CLAIMS_METADATA_NAME, tokenMetadata))
                .token(refreshToken, (metadata) -> metadata.put(OAuth2Authorization.Token.CLAIMS_METADATA_NAME, refreshTokenMetadata))
                .build();
}

The serialization seems to work but not the deserialization. You mentionned a How-to guide in your comment, where can I find a reference guide or should I define a custom mixin? Thank you

@mbarringer @edwardzjl @colin-riddell This issue is related to a bug in Spring Security. See spring-security#9993. There is a fix in place and will be released in 5.7.0 GA, which is a way out.

FYI, the OAuth2ClientAuthenticationToken and JwtAuthenticationToken are marked as @Transient and therefore should NOT be persisted across requests. However, it is being persisted across requests, resulting in this bug.

Since Spring Security 5.7.0 GA is a way out, I’ve applied a temporary fix via d0e1107

It seems that the attributes column is not properly (serialized and) deserialized. I’m interested in making a PR of this issue.