spring-projects / spring-projects/spring-security

Log on OpenID connect fallback

Open
#17,677 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

I have an open-id connect provider (id-austria) that replies to a token-request with an invalid token (only 2 parts, not 3).
spring-security then tries to get the id-token from the user-info-uri. But that provider has no user-info-uri, since all user-info is already there in the token (part 1+2)
Spring-security then logs "...ProviderManager: Authentication failed with provider OAuth2LoginAuthenticationProvider since [missing_user_info_uri] Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: id-austria"

Expected Behavior

spring-security should log fallback-behavior like this. e.g. "Invalid id-token provided, trying to retrieve it form UserInfoEndpoint for Client Registration: id-austria"

Current Behavior
After the response (200 OK), spring-security logs:
RestTemplate : Reading to [org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse] as "application/json;charset=UTF-8"
ProviderManager : Authentication failed with provider OAuth2LoginAuthenticationProvider since [missing_user_info_uri] Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: id-austria

no info that this is a fallback mechanism due to the invalid id-token is given

Context

I've enabled the following logs:
logging.level.org.springframework.security=DEBUG
logging.level.org.springframework.web=DEBUG
logging.level.org.springframework.security.web.FilterChainProxy=DEBUG
logging.level.org.springframework.security.oauth2.client=DEBUG
logging.level.org.springframework.security.oauth2.client.endpoint=TRACE

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at OAuth2LoginAuthenticationProvider and the fallback from an invalid token to UserInfoEndpoint, using the reported DEBUG and TRACE logs to trace the current message path. Update the fallback logging so it identifies the invalid ID token and the attempted UserInfoEndpoint retrieval, then verify the resulting logs for the id-austria scenario.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.