spring-projects / spring-projects/spring-security

Logging in via oauth2 using redis session throws jackson error

Open Beginner friendly
#19,077 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

I initially created this issue in spring session, but I now believe it belongs here.

Describe the bug
When I attempt to login via oauth 2 using redis sessions I get this jackson error

org.springframework.data.redis.serializer.SerializationException: Could not read JSON:Could not resolve type id 'java.net.URL' as a subtype of `java.lang.Object`: Configured `PolymorphicTypeValidator` (of type `tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator`) denied resolution
 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); byte offset: #1988] (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]->org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken["principal"]->org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser["authorities"]->java.util.HashSet[0]->org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority["idToken"]->org.springframework.security.oauth2.core.oidc.OidcIdToken["claims"]->java.util.LinkedHashMap["iss"])

the error location of the json in redis appears to be here

          "iss": [
            "java.net.URL",
            "https://accounts.google.com"
          ],

I am using the documentation code for 4.0.1-SNAPSHOT

Sample

Here is a link to the sample. To set it up add your oauth2 details to application.yml, start up spring boot and attempt to login

This comment fixes the issue, so I believe the Url.class needs to be added to OAuth2ClientJacksonModule

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with OAuth2ClientJacksonModule.java at the referenced registration point, then reproduce the Redis-session OAuth2 login using the linked sample and application.yml setup. Confirm how the java.net.URL claim is serialized and deserialized, and verify that the login no longer throws the PolymorphicTypeValidator error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, redis, spring
Domain
authentication, backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
75/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.