spring-projects / spring-projects/spring-security
Default `OidcUser` conversion may return mismatch between `OAuth2User.getName()` and `OidcUser.getName()`
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Both OidcUserService and OidcReactiveOAuth2UserService may return an OidUser with a different username than the injected (Reactive)OAuth2UserService.
For example, OidcUserService is created without even having access to the OAuth2User.
Note that this blocks gh-16857 since it impacts how the name is resolved.
Related gh-17626 gh-17627 gh-16857
cc @jgrandja
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with OidcUserService.java at the linked construction point and compare it with OidcReactiveOAuth2UserService, including how each uses the injected (Reactive)OAuth2UserService. Trace OAuth2User.getName() and OidcUser.getName() through both conversion paths; done means the names no longer mismatch and the behavior blocking gh-16857 is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100