Open limburgie opened 2 months ago
Hi, @limburgie, can you please confirm whether you mean DefaultOAuth2AuthenticatedPrincipal
or DefaultSaml2AuthenticatedPrincipal
? It may be that we want to implement equals
and hashCode
in both, I just want to make sure we attribute the right thing to this ticket.
Hi @jzheaux, thanks for your response. Our issue would be fixed by implementing it in DefaultSaml2AuthenticatedPrincipal
.
@jzheaux any update on this ticket? Can this issue be considered for a future minor?
Context
Using Spring Boot 3.3.0 with:
Bug description
We have set up Spring Authorization Server with an implementation of
OAuth2AuthorizationService
that persists authorizations in the database via JPA (following https://docs.spring.io/spring-authorization-server/reference/guides/how-to-jpa.html). Also, our Authorization Server delegates authentication to a SAML IdP.The flow works correctly, but signing out fails complaining the
"sid"
claim in the OIDC token is missing due toSessionInformation
not found at token generation time. See https://github.com/spring-projects/spring-authorization-server/issues/1361 for a similar description.When the JPA based
OAuth2AuthorizationService
is replaced byInMemoryOAuth2AuthorizationService
, the whole flow works as expected.Debugging shows that the problem is in the
SessionRegistryImpl
, which keeps aMap<DefaultSaml2AuthenticatedPrincipal, Set<String>>
in this scenario. When building the token inOAuth2AuthorizationCodeAuthenticationProvider:249
Spring tries to get session information for the principal, so it does aget()
on the map (SessionRegistryImpl:78
).The problem here is that
DefaultSaml2AuthenticatedPrincipal
was serialized and deserialized because of the JPA implementation of theOAuth2AuthorizationService
(as an attribute ofOAuth2Authorization
). After deserialization, it is a new instance and becauseDefaultSaml2AuthenticatedPrincipal
does not implement anequals
/hashCode
method, the map retrieval always fails, so the linked Session ID is never found.Solution
The solution would be to implement an
equals
/hashCode
forDefaultSaml2AuthenticatedPrincipal
so the Session ID can be found, the "sid" claim in the OIDC token can be filled with the Session ID and logout will work correctly.Workaround
As a (dirty) workaround for this issue we have implemented a custom implementation for
SessionRegistry
that searches the right principal in the map without relying on object identity.But it goes without saying that the issue should be resolved in
DefaultSaml2AuthenticatedPrincipal
, similar to e.g.DefaultOAuth2User
which is also anAuthenticatedPrincipal
implementation.See also https://stackoverflow.com/questions/77093539/sid-missing-in-id-token-using-spring-authorization-server