Improve ClaimAccessor getClaimAsInstant #5250

Activity

1. jzheaux

   added

   type: enhancementA general enhancementA general enhancement

   JWT-JOSE

   on Apr 20, 2018
2. jgrandja

   added this to the 5.1.0.M1 milestone on Apr 20, 2018
3. jgrandja

   assigned

   jgrandja

   and

   jzheaux

   and unassigned

   jgrandja

   on Apr 20, 2018
4. jgrandja

   assigned

   jgrandja

   and unassigned

   jzheaux

   on May 4, 2018
5. jgrandja

   closed this as completedin fff64dbon May 4, 2018
6. sirianni commented on Jun 12, 2018

   

   sirianni

   on Jun 12, 2018

   More actions

   I'm getting a similar error when the claims value is a java.lang.String. Using the auth0 API, updated_at is returned as 2018-06-12T01:35:40.304Z. Even though this is a valid ISO Date, this is getting stored as a java.lang.String in the underlying claims map from the JWT, which is ultimately resulting in the IllegalArgumentException. I'm not sure why getClaimAsInstant is assuming that the JWT library would have the intelligence to parse Strings into Dates - it doesn't attach any semantics to the fields.

   java.lang.IllegalArgumentException: Unable to convert claim 'updated_at' of type 'class java.lang.String' to Instant.
   	at org.springframework.security.oauth2.core.ClaimAccessor.getClaimAsInstant(ClaimAccessor.java:96)
   	at org.springframework.security.oauth2.core.oidc.StandardClaimAccessor.getUpdatedAt(StandardClaimAccessor.java:218)
   	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
   	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
   	at java.lang.reflect.Method.invoke(Method.java:498)
   
7. jgrandja commented on Jun 13, 2018

   

   jgrandja

   on Jun 13, 2018

   Collaborator

   More actions

   @sirianni As per the spec, in 5.1. Standard Claims:

   updated_at | number | Time the End-User's information was last updated. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.

   Looks like auth0 is not storing it as a number as expected, hence the error. You can always use getClaimAsString(StandardClaimNames.UPDATED_AT) to avoid the error.
8. rwinch

   added

   in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

   on May 3, 2019