search

spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.55k stars 5.79k forks source link

SpringOpaqueTokenIntrospector does not add scopes as granted authorities properly #15165

Closed Veil closed 4 weeks ago

Veil commented 1 month ago

Describe the bug Since the introduction of the authenticationConverter in 6.3, the default implementation (this::defaultAuthenticationConverter) does not add found scopes as granted authorities as part of introspection because the check if (!(scopes instanceof ArrayListFromString)) always returns false on line 261, as by the time the scopes list reaches here, it has been converted into a normal ArrayList in the accessor.getScopes() as part of the getClaimAsStringList default method without customising the ClaimConversionService and therefore fails the check above and returns an empty list.

To Reproduce Use the default implementation of SpringOpaqueTokenIntrospector without customisation of it or the ClaimConversionService used by the ClaimAccessor interface.

Expected behavior Scopes are added correctly as "SCOPE_" granted authorities.

Sample

Not sure a sample is required here? This is the default behaviour.

jzheaux commented 4 weeks ago

Thanks, @Veil, for the report. This is now fixed in main and will go out in the next snapshot.

Veil commented 4 weeks ago

@jzheaux awesome. For personal curiosity, what's the thinking behind not supporting any other List implementation in the defaultAuthenticationConverter? It doesn't look like we're doing anything special with that type?