spring-projects / spring-projects/spring-security
Oauth2: Lookup from oauth2 well-known endpoint fails, if lookup of the oidc well-known endpoint errors
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
When trying to use a oauth2 authorization server, that only provides the oauth2 well-known endpoint (/.well-known/oauth-authorization-server), the automated lookup of meta-data fails, because spring security tries to lookup the oidc well known endpoint first, which results in an error. In my case the error is the following:
Caused by: org.springframework.web.client.UnknownContentTypeException: Could not extract response: no suitable HttpMessageConverter found for response type [java.util.Map<java.lang.String, java.lang.Object>] and content type [text/html]
To Reproduce
Setup a oauth2 authorization server, that does not support oidc and instead serves a html error page, when trying to lookup
/.well-known/openid-configuration
Expected behavior
The error from looking up the oidc well-known endpoint should be ignored or maybe a config property can be introduced, to make clear what the type of issuer actually is (plain oauth2 vs oidc). This could prevent looking at the wrong place from start.
Sample
Let me know if a sample is needed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the automated metadata lookup against an OAuth2 authorization server that serves HTML for /.well-known/openid-configuration but supports /.well-known/oauth-authorization-server. Trace the lookup entry point and existing tests for well-known endpoints. Done means OAuth2-only metadata lookup succeeds without the OIDC endpoint error, with coverage for this response scenario.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100