OAuth2AccessTokenResponseBodyExtractor should support Object values

[hfgbarrigas]

Summary

When dealing with additional information in the token response (<String, Object>) jackson throws an exception. Looking at OAuth2AccessTokenResponseBody class to extract the OAuth2AccessTokenResponse:

@Override
public Mono<OAuth2AccessTokenResponse> extract(ReactiveHttpInputMessage inputMessage,
			Context context) {
		ParameterizedTypeReference<Map<String, String>> type = new ParameterizedTypeReference<Map<String, String>>() {};
		BodyExtractor<Mono<Map<String, String>>, ReactiveHttpInputMessage> delegate = BodyExtractors.toMono(type);
		return delegate.extract(inputMessage, context)
				.map(json -> parse(json))
				.flatMap(OAuth2AccessTokenResponseBodyExtractor::oauth2AccessTokenResponse)
				.map(OAuth2AccessTokenResponseBodyExtractor::oauth2AccessTokenResponse);
}

Looks like Map<String, String> is forced and values other than strings cannot be parsed. Down below on parse (line 66) new JSONObject() can deal with Map<String, ?>.

Actual Behavior

Exception thrown on jackson.

Caused by: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize instance of java.lang.String out of START_ARRAY token
at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: java.util.LinkedHashMap["client_authorities"])

Expected Behavior

{"access_token":"accessToken","token_type":"bearer","expires_in":6568,"scope":"all","grant_type":"client_credentials","organization":"HOLD","client_authorities":["INTERNAL"],"jti":"72ebfbf1-2686-450b-8dd1-525a704e6aa1"}

Token example shown above should be parsed correctly and OAuth2AccessTokenResponse correctly constructed.

Version

5.1.3.BUILD-SNAPSHOT

Sample

https://github.com/hfgbarrigas/oauth2client-webflux-error-sample

[rwinch]

Thanks for the report @hfgbarrigas! This is now fixed in master with a PR from @raphaelDL (thanks for the PR!). The code was also backported to 5.1.x via #6100

[hfgbarrigas]

Great. Is there a snapshot to test?

[rwinch]

Yes. Please see https://docs.spring.io/spring-security/site/docs/5.1.x-SNAPSHOT/reference/htmlsingle/#get-spring-security