Closed lArtiquel closed 1 year ago
Resolves #100 issue Sorry for duplicating, didn't plan to create a PR at the beginning
There is a 5.x branch and you should be able to create another pull-request, and sure, your patch should be applied there too.
I suggest you git checkout 5.x; git cherry-pick c828d2dd1b806536adb87cf9fa102722ca7d5db1
then create a second pull-request targeting ch4mpy:5.x
.
Description Hello 👋
I spotted a small bug while testing a multi-tentancy feature.
Expected Result In my use-case scenario, REST API endpoint call to the resource server with auth token issued by Realm not specified in the
com.c4-soft.springaddons.security.issuers[*].location
list, should return 401 (Unauthorized) Status Code instead of 500 SC.Debugging process explained
java.lang.NullPointerException: null at org.springframework.security.oauth2.server.resource.authentication.JwtIssuerReactiveAuthenticationManagerResolver$ResolvingAuthenticationManager.lambda$authenticate$1(JwtIssuerReactiveAuthenticationManagerResolver.java:145) ~[spring-security-oauth2-resource-server-5.5.4.jar:5.5.4] Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException: Error has been observed at the following site(s): __checkpoint ⇢ org.springframework.security.web.server.authentication.AuthenticationWebFilter [DefaultWebFilterChain] checkpoint ⇢ org.springframework.security.web.server.context.ReactorContextWebFilter [DefaultWebFilterChain] *checkpoint ⇢ org.springframework.security.web.server.header.HttpHeaderWriterWebFilter [DefaultWebFilterChain] __checkpoint ⇢ org.springframework.security.config.web.server.ServerHttpSecurity$ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain] checkpoint ⇢ org.springframework.security.web.server.WebFilterChainProxy [DefaultWebFilterChain] *checkpoint ⇢ org.springframework.boot.actuate.metrics.web.reactive.server.MetricsWebFilter [DefaultWebFilterChain] *__checkpoint ⇢ HTTP GET "/dummy" [ExceptionHandlingWebHandler]
return this.issuerAuthenticationManagerResolver.resolve(issuer).switchIfEmpty(Mono.error(() -> { return new InvalidBearerTokenException("Invalid issuer " + issuer); }));