spring-projects / spring-projects/spring-security

Fix for issue 18282 breaks remember-me feature

Open
#19,198 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
ID-Token can not be created for remember-me user

To Reproduce

  1. Log in to a client with the openid scope using only the remember-me cookie (no regular session cookie).
  2. The ID token cannot be created due to the following exception:

java.lang.IllegalArgumentException: authenticationTime cannot be null
at org.springframework.util.Assert.notNull(Assert.java:182)
at o.s.s.o.server.authorization.token.JwtGenerator.getAuthenticationTime(JwtGenerator.java:237)
at o.s.s.o.server.authorization.token.JwtGenerator.generate(JwtGenerator.java:147)

Reason: The Authentication object created by remember-me does not contain a FactorGrantedAuthority (see attached image).

Image

Additionally, FactorGrantedAuthority appears to have been introduced in Spring Security 7.0. Does this mean that all previously created and persisted authorizations will be broken?

Expected behavior
No exception should occur.

Sample

https://github.com/alsha/sas-rememberme-idtoken-repro

git clone https://github.com/alsha/sas-rememberme-idtoken-repro
cd sas-rememberme-idtoken-repro
mvn test

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided reproducer, alsha/sas-rememberme-idtoken-repro, and run mvn test to observe the remember-me failure. Trace the stack from JwtGenerator.generate through JwtGenerator.getAuthenticationTime; done means an ID token is created without the authenticationTime cannot be null exception for a remember-me-only session.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.