Improve ClaimAccessor getClaimAsInstant

[jzheaux]

Summary

ClaimAccessor#getClaimAsInstant attempts to coerce a claim into an Instant, so long as it is of type Long, Date, or Instant.

Actual Behavior

ClaimAccessor#getClaimAsInstant fails when the claim is of type Integer

Expected Behavior

ClaimAccessor#getClaimAsInstant should be resilient to all whole-number data types, but at least those that extend from Number.

Version

5.1.0.BUILD-SNAPSHOT

[sirianni]

I'm getting a similar error when the claims value is a java.lang.String. Using the auth0 API, updated_at is returned as 2018-06-12T01:35:40.304Z. Even though this is a valid ISO Date, this is getting stored as a java.lang.String in the underlying claims map from the JWT, which is ultimately resulting in the IllegalArgumentException. I'm not sure why getClaimAsInstant is assuming that the JWT library would have the intelligence to parse Strings into Dates - it doesn't attach any semantics to the fields.

java.lang.IllegalArgumentException: Unable to convert claim 'updated_at' of type 'class java.lang.String' to Instant.
	at org.springframework.security.oauth2.core.ClaimAccessor.getClaimAsInstant(ClaimAccessor.java:96)
	at org.springframework.security.oauth2.core.oidc.StandardClaimAccessor.getUpdatedAt(StandardClaimAccessor.java:218)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)

[jgrandja]

@sirianni As per the spec, in 5.1. Standard Claims:

updated_at | number | Time the End-User's information was last updated. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.

Looks like auth0 is not storing it as a number as expected, hence the error. You can always use getClaimAsString(StandardClaimNames.UPDATED_AT) to avoid the error.