spring-projects / spring-projects/spring-security

Consider adding runtime hints to support oauth2Login() and oauth2Client()

Open
#18,145 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
When running a native spring boot image with spring security and redis sessions I get an error both with JDK serialization and the json serialization when trying to login via oauth2. It looks like there is this bug in spring session which seems related.

Specifically for the jackson error it looks like this not all the modules are in the loader

SecurityJackson2Modules.getModules(this.loader)

in particular these

org.springframework.security.oauth2.client.jackson2.OAuth2ClientJackson2Module
org.springframework.security.web.jackson2.WebJackson2Module
org.springframework.security.web.server.jackson2.WebServerJackson2Module

are missing in the native image, but not the non-native image

To Reproduce
The Steps to reproduce are in the readme of the sample

Expected behavior
There should be no error when running a native image

Sample

Sample

A snippet from the error

org.springframework.data.redis.serializer.SerializationException: Could not read JSON:Class org.springframework.security.oauth2.client.jackson2.OAuth2AuthorizationRequestDeserializer has no default (no arg) constructor

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the reproduction steps in the NativeSpringSession sample README and inspect SecurityJackson2Modules.getModules(this.loader) along with the three listed OAuth2, web, and web-server Jackson modules. Verify the native-image path against the non-native path, then confirm that OAuth2 login completes without the reported serialization or no-arg-constructor error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, redis, spring, spring-boot
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.