spring-projects / spring-projects/spring-security

Error on Spring Authorization server when issuing Id token after migrating from Spring boot 4.0.5 -> 4.0.7

Open
#19,371 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: bug
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Describe the bug
Migrate a service from spring boot 4.0.5 to 4.0.7 which

  • acts as Authorization server
  • acts as Resource server (user authenticates using OIDC within external IDP)

To Reproduce

  1. Configure service which uses spring boot 4.0.7 to act as:
  • authorization server
  • resource server
  1. Log in using OIDC federation
  2. Authenticated session is established with the service, based on IdToken retrieved from external IDP
  3. Hit /oauth2/authorize endpoint to retrieve "Authorization Server" issued IdToken/AccessToken

Exception is thrown (details, see screenshot):
java.lang.IllegalArgumentException: authenticationTime cannot be null
at org.springframework.util.Assert.notNull(Assert.java:182)
at org.springframework.security.oauth2.server.authorization.token.JwtGenerator.getAuthenticationTime(JwtGenerator.java:237)
at org.springframework.security.oauth2.server.authorization.token.JwtGenerator.generate(JwtGenerator.java:147)
at org.springframework.security.oauth2.server.authorization.token.JwtGenerator.generate(JwtGenerator.java:66)
at org.springframework.security.oauth2.server.authorization.token.DelegatingOAuth2TokenGenerator.generate(DelegatingOAuth2TokenGenerator.java:60)
at org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationProvider.authenticate(OAuth2AuthorizationCodeAuthenticationProvider.java:274)

Expected behavior
No exception is thrown,

Image

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OAuth2AuthorizationCodeAuthenticationProvider and DelegatingOAuth2TokenGenerator stack-trace entries, then inspect JwtGenerator.generate and getAuthenticationTime. Reproduce the authorization-server and resource-server flow after the Spring Boot migration; done means issuing the server-generated ID token and access token without the authenticationTime exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.