spring-projects / spring-projects/spring-security

Oauth2: Lookup from oauth2 well-known endpoint fails, if lookup of the oidc well-known endpoint errors

Open
#17,036 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
When trying to use a oauth2 authorization server, that only provides the oauth2 well-known endpoint (/.well-known/oauth-authorization-server), the automated lookup of meta-data fails, because spring security tries to lookup the oidc well known endpoint first, which results in an error. In my case the error is the following:

Caused by: org.springframework.web.client.UnknownContentTypeException: Could not extract response: no suitable HttpMessageConverter found for response type [java.util.Map<java.lang.String, java.lang.Object>] and content type [text/html]

To Reproduce
Setup a oauth2 authorization server, that does not support oidc and instead serves a html error page, when trying to lookup
/.well-known/openid-configuration

Expected behavior
The error from looking up the oidc well-known endpoint should be ignored or maybe a config property can be introduced, to make clear what the type of issuer actually is (plain oauth2 vs oidc). This could prevent looking at the wrong place from start.

Sample
Let me know if a sample is needed.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the automated metadata lookup against an OAuth2 authorization server that serves HTML for /.well-known/openid-configuration but supports /.well-known/oauth-authorization-server. Trace the lookup entry point and existing tests for well-known endpoints. Done means OAuth2-only metadata lookup succeeds without the OIDC endpoint error, with coverage for this response scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.