spring-projects / spring-projects/spring-security
Consider adding runtime hints to support oauth2Login() and oauth2Client()
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Describe the bug
When running a native spring boot image with spring security and redis sessions I get an error both with JDK serialization and the json serialization when trying to login via oauth2. It looks like there is this bug in spring session which seems related.
Specifically for the jackson error it looks like this not all the modules are in the loader
SecurityJackson2Modules.getModules(this.loader)
in particular these
org.springframework.security.oauth2.client.jackson2.OAuth2ClientJackson2Module
org.springframework.security.web.jackson2.WebJackson2Module
org.springframework.security.web.server.jackson2.WebServerJackson2Module
are missing in the native image, but not the non-native image
To Reproduce
The Steps to reproduce are in the readme of the sample
Expected behavior
There should be no error when running a native image
Sample
A snippet from the error
org.springframework.data.redis.serializer.SerializationException: Could not read JSON:Class org.springframework.security.oauth2.client.jackson2.OAuth2AuthorizationRequestDeserializer has no default (no arg) constructor
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the reproduction steps in the NativeSpringSession sample README and inspect SecurityJackson2Modules.getModules(this.loader) along with the three listed OAuth2, web, and web-server Jackson modules. Verify the native-image path against the non-native path, then confirm that OAuth2 login completes without the reported serialization or no-arg-constructor error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, redis, spring, spring-boot
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100