Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-05-30 16:52:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Avoid ClassCastException if principalClaim value is not a String

Browse Source 
Closes gh-9212
This commit is contained in:
olivier.antoine 2020-11-23 21:05:32 +01:00 committed by Josh Cummings
parent fe93326087
commit 808b8c3256
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/JwtAuthenticationConverter.java
View File

@ -29,6 +29,7 @@ import org.springframework.util.Assert;
* @author Rob Winch * @author Rob Winch
* @author Josh Cummings * @author Josh Cummings
* @author Evgeniy Cheban * @author Evgeniy Cheban
* @author Olivier Antoine
* @since 5.1 * @since 5.1
*/ */
public class JwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> { public class JwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> {
@ -43,8 +44,8 @@ public class JwtAuthenticationConverter implements Converter<Jwt, AbstractAuthen
if (this.principalClaimName == null) { if (this.principalClaimName == null) {
return new JwtAuthenticationToken(jwt, authorities); return new JwtAuthenticationToken(jwt, authorities);
} }
String name = jwt.getClaim(this.principalClaimName); String principalClaimValue = jwt.getClaimAsString(this.principalClaimName);
return new JwtAuthenticationToken(jwt, authorities, name); return new JwtAuthenticationToken(jwt, authorities, principalClaimValue);
} }
/** /**

9
oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/JwtAuthenticationConverterTests.java
View File

@ -36,6 +36,7 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
* *
* @author Josh Cummings * @author Josh Cummings
* @author Evgeniy Cheban * @author Evgeniy Cheban
* @author Olivier Antoine
*/ */
public class JwtAuthenticationConverterTests { public class JwtAuthenticationConverterTests {
@ -103,4 +104,12 @@ public class JwtAuthenticationConverterTests {
assertThat(authentication.getName()).isEqualTo("100"); assertThat(authentication.getName()).isEqualTo("100");
} }
@Test
public void convertWhenPrincipalClaimNameSetAndClaimValueIsNotString() {
this.jwtAuthenticationConverter.setPrincipalClaimName("user_id");
Jwt jwt = TestJwts.jwt().claim("user_id", 100).build();
AbstractAuthenticationToken authentication = this.jwtAuthenticationConverter.convert(jwt);
assertThat(authentication.getName()).isEqualTo("100");
}
} }