Skip to content

Add mapping for DPoP in DefaultMapOAuth2AccessTokenResponseConverter #16806

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

hammadirshad
Copy link
Contributor

This PR adds the missing mapping for the newly introduced TokenType.DPOP in DefaultMapOAuth2AccessTokenResponseConverter. Without this mapping, deserializing an OAuth 2.0 Access Token Response containing a DPoP token type results in an error:
An error occurred reading the OAuth 2.0 Access Token Response: tokenType cannot be null

Stacktrace

org.springframework.web.client.RestClientException: Error while extracting response for type [org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse] and content type [application/json;charset=UTF-8]
	at org.springframework.web.client.DefaultRestClient.readWithMessageConverters(DefaultRestClient.java:261) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.readBody(DefaultRestClient.java:814) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.lambda$body$0(DefaultRestClient.java:745) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultRequestBodyUriSpec.exchangeInternal(DefaultRestClient.java:574) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultRequestBodyUriSpec.exchange(DefaultRestClient.java:535) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.RestClient$RequestHeadersSpec.exchange(RestClient.java:677) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.executeAndExtract(DefaultRestClient.java:809) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.body(DefaultRestClient.java:745) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.security.oauth2.client.endpoint.AbstractRestClientOAuth2AccessTokenResponseClient.getTokenResponse(AbstractRestClientOAuth2AccessTokenResponseClient.java:94) ~[spring-security-oauth2-client-6.5.0-M3.jar:6.5.0-M3]
	... 25 common frames omitted
Caused by: org.springframework.http.converter.HttpMessageNotReadableException: An error occurred reading the OAuth 2.0 Access Token Response: tokenType cannot be null
	at org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter.readInternal(OAuth2AccessTokenResponseHttpMessageConverter.java:81) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	at org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter.readInternal(OAuth2AccessTokenResponseHttpMessageConverter.java:47) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	at org.springframework.http.converter.AbstractHttpMessageConverter.read(AbstractHttpMessageConverter.java:198) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient.readWithMessageConverters(DefaultRestClient.java:244) ~[spring-web-6.2.5.jar:6.2.5]
	... 33 common frames omitted
Caused by: java.lang.IllegalArgumentException: tokenType cannot be null
	at org.springframework.util.Assert.notNull(Assert.java:181) ~[spring-core-6.2.5.jar:6.2.5]
	at org.springframework.security.oauth2.core.OAuth2AccessToken.<init>(OAuth2AccessToken.java:76) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	at org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse$Builder.build(OAuth2AccessTokenResponse.java:191) ~[spring-security-oauth2-core-6.5.0-M3.jar:na]
	at org.springframework.security.oauth2.core.endpoint.DefaultMapOAuth2AccessTokenResponseConverter.convert(DefaultMapOAuth2AccessTokenResponseConverter.java:64) ~[classes/:na]
	at org.springframework.security.oauth2.core.endpoint.DefaultMapOAuth2AccessTokenResponseConverter.convert(DefaultMapOAuth2AccessTokenResponseConverter.java:37) ~[classes/:na]
	at org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter.readInternal(OAuth2AccessTokenResponseHttpMessageConverter.java:77) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	... 36 common frames omitted

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Mar 23, 2025
@sjohnr sjohnr added type: enhancement A general enhancement in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) labels Apr 9, 2025
@jgrandja
Copy link
Contributor

@hammadirshad

The Spring team recently migrated to the Developer Certificate of Origin (DCO) for our contribution process. See Submitting Pull Requests for additional details on the new process. Please format the commit in this PR as the DCO check did not pass.

The changes look good in the PR so we'll get this merged as soon as the DCO check passes. However, please update the copyright year in the 2 files. Thank you.

@jgrandja jgrandja removed the status: waiting-for-triage An issue we've not yet triaged label Apr 18, 2025
@jgrandja jgrandja modified the milestones: 6.5.0-RC1, 6.5.0 Apr 18, 2025
@hammadirshad
Copy link
Contributor Author

Hi @jgrandja
I have updated the copyright year and added Signed-off-by for DCO check.

@jgrandja jgrandja changed the title Added a mapping for DPOP TokenType in DefaultMapOAuth2AccessTokenResponseConverter Add mapping for DPoP in DefaultMapOAuth2AccessTokenResponseConverter Apr 30, 2025
@jgrandja jgrandja closed this in 1a4602c Apr 30, 2025
@jgrandja
Copy link
Contributor

Thanks for the update @hammadirshad. This is now merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants