Skip to content

Conversation

hammadirshad
Copy link
Contributor

This PR adds the missing mapping for the newly introduced TokenType.DPOP in DefaultMapOAuth2AccessTokenResponseConverter. Without this mapping, deserializing an OAuth 2.0 Access Token Response containing a DPoP token type results in an error:
An error occurred reading the OAuth 2.0 Access Token Response: tokenType cannot be null

Stacktrace

org.springframework.web.client.RestClientException: Error while extracting response for type [org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse] and content type [application/json;charset=UTF-8]
	at org.springframework.web.client.DefaultRestClient.readWithMessageConverters(DefaultRestClient.java:261) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.readBody(DefaultRestClient.java:814) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.lambda$body$0(DefaultRestClient.java:745) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultRequestBodyUriSpec.exchangeInternal(DefaultRestClient.java:574) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultRequestBodyUriSpec.exchange(DefaultRestClient.java:535) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.RestClient$RequestHeadersSpec.exchange(RestClient.java:677) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.executeAndExtract(DefaultRestClient.java:809) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient$DefaultResponseSpec.body(DefaultRestClient.java:745) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.security.oauth2.client.endpoint.AbstractRestClientOAuth2AccessTokenResponseClient.getTokenResponse(AbstractRestClientOAuth2AccessTokenResponseClient.java:94) ~[spring-security-oauth2-client-6.5.0-M3.jar:6.5.0-M3]
	... 25 common frames omitted
Caused by: org.springframework.http.converter.HttpMessageNotReadableException: An error occurred reading the OAuth 2.0 Access Token Response: tokenType cannot be null
	at org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter.readInternal(OAuth2AccessTokenResponseHttpMessageConverter.java:81) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	at org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter.readInternal(OAuth2AccessTokenResponseHttpMessageConverter.java:47) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	at org.springframework.http.converter.AbstractHttpMessageConverter.read(AbstractHttpMessageConverter.java:198) ~[spring-web-6.2.5.jar:6.2.5]
	at org.springframework.web.client.DefaultRestClient.readWithMessageConverters(DefaultRestClient.java:244) ~[spring-web-6.2.5.jar:6.2.5]
	... 33 common frames omitted
Caused by: java.lang.IllegalArgumentException: tokenType cannot be null
	at org.springframework.util.Assert.notNull(Assert.java:181) ~[spring-core-6.2.5.jar:6.2.5]
	at org.springframework.security.oauth2.core.OAuth2AccessToken.<init>(OAuth2AccessToken.java:76) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	at org.springframework.security.oauth2.core.endpoint.OAuth2AccessTokenResponse$Builder.build(OAuth2AccessTokenResponse.java:191) ~[spring-security-oauth2-core-6.5.0-M3.jar:na]
	at org.springframework.security.oauth2.core.endpoint.DefaultMapOAuth2AccessTokenResponseConverter.convert(DefaultMapOAuth2AccessTokenResponseConverter.java:64) ~[classes/:na]
	at org.springframework.security.oauth2.core.endpoint.DefaultMapOAuth2AccessTokenResponseConverter.convert(DefaultMapOAuth2AccessTokenResponseConverter.java:37) ~[classes/:na]
	at org.springframework.security.oauth2.core.http.converter.OAuth2AccessTokenResponseHttpMessageConverter.readInternal(OAuth2AccessTokenResponseHttpMessageConverter.java:77) ~[spring-security-oauth2-core-6.5.0-M3.jar:6.5.0-M3]
	... 36 common frames omitted

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Mar 23, 2025
@sjohnr sjohnr added type: enhancement A general enhancement in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) labels Apr 9, 2025
@jgrandja
Copy link
Contributor

@hammadirshad

The Spring team recently migrated to the Developer Certificate of Origin (DCO) for our contribution process. See Submitting Pull Requests for additional details on the new process. Please format the commit in this PR as the DCO check did not pass.

The changes look good in the PR so we'll get this merged as soon as the DCO check passes. However, please update the copyright year in the 2 files. Thank you.

@jgrandja jgrandja removed the status: waiting-for-triage An issue we've not yet triaged label Apr 18, 2025
@jgrandja jgrandja modified the milestones: 6.5.0-RC1, 6.5.0 Apr 18, 2025
@hammadirshad
Copy link
Contributor Author

Hi @jgrandja
I have updated the copyright year and added Signed-off-by for DCO check.

@jgrandja jgrandja changed the title Added a mapping for DPOP TokenType in DefaultMapOAuth2AccessTokenResponseConverter Add mapping for DPoP in DefaultMapOAuth2AccessTokenResponseConverter Apr 30, 2025
@jgrandja jgrandja closed this in 1a4602c Apr 30, 2025
@jgrandja
Copy link
Contributor

Thanks for the update @hammadirshad. This is now merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) type: enhancement A general enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants