ClassCastException when use oidcUserService delegate #9512

kazakovav · 2021-03-19T06:08:16Z

Hello!
I try to login user in my application, when using OAuth2 client and spring-boot-starter-parent:2.4.4.
But, When I use spring-boot-starter-parent:2.3.9.RELEASE, it's works correctly

run application and try to log in

please, see example in
https://github.com/kazakovav/spring-boot-keycloak/tree/main/demo-keycloak-oauth

jgrandja · 2021-03-19T14:52:20Z

@kazakovav I took a look at your sample and it needs to be simplified so it follows a Minimal Reproducible Example.

Your sample is expecting a running Keycloak instance and there are no directions on how to reproduce the error. Please update the sample so it's easy for me to reproduce.

As an FYI, this sample uses Keycloak, so you might want to look at it and compare to your sample.

kazakovav · 2021-03-22T06:55:43Z

Sorry!
I have changed the example (https://github.com/kazakovav/spring-oauth-classcast), docker-compose.yml was added for start keycloak: You just need to start via docker-compose up -D in keycloak directory.
Also I forgot to attach stacktrace:

2021-03-22 09:53:49.757 ERROR 48396 --- [nio-8080-exec-3] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception

java.lang.ClassCastException: class org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest cannot be cast to class org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest (org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest and org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest are in unnamed module of loader 'app')
	at org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationProvider.authenticate(OAuth2LoginAuthenticationProvider.java:117) ~[spring-security-oauth2-client-5.4.5.jar:5.4.5]
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182) ~[spring-security-core-5.4.5.jar:5.4.5]
	at org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter.attemptAuthentication(OAuth2LoginAuthenticationFilter.java:192) ~[spring-security-oauth2-client-5.4.5.jar:5.4.5]
	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:222) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter.doFilterInternal(OAuth2AuthorizationRequestRedirectFilter.java:178) ~[spring-security-oauth2-client-5.4.5.jar:5.4.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:117) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183) ~[spring-security-web-5.4.5.jar:5.4.5]
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) ~[na:na]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) ~[na:na]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at java.base/java.lang.Thread.run(Thread.java:832) ~[na:na]

jgrandja · 2021-03-26T18:59:46Z

@kazakovav The following error:

org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest are in unnamed module of loader 'app'

seems like it's related to the docker image as I've never seen such an error.

I'd rather take docker out of the mix to ensure the sample is as minimal as possible.

This sample uses Keycloak without docker. Please modify your sample to exclude docker.

wsaca · 2021-03-31T23:49:41Z

I have a similar error message:

Caused by: java.lang.ClassCastException: class com.nimbusds.jose.Algorithm cannot be cast to class com.nimbusds.jose.JWSAlgorithm (com.nimbusds.jose.Algorithm and com.nimbusds.jose.JWSAlgorithm are in unnamed module of loader 'app')
	at org.springframework.security.oauth2.jwt.JwtDecoderProviderConfigurationUtils.getSignatureAlgorithms(JwtDecoderProviderConfigurationUtils.java:93) ~[spring-security-oauth2-jose-5.5.0-M3.jar:5.5.0-M3]
	at org.springframework.security.oauth2.jwt.JwtDecoders.withProviderConfiguration(JwtDecoders.java:122) ~[spring-security-oauth2-jose-5.5.0-M3.jar:5.5.0-M3]
	at org.springframework.security.oauth2.jwt.JwtDecoders.fromOidcIssuerLocation(JwtDecoders.java:66) ~[spring-security-oauth2-jose-5.5.0-M3.jar:5.5.0-M3]
	at ec.edu.ups.talos.config.SecurityConfiguration.jwtDecoder(SecurityConfiguration.java:100) ~[main/:na]

I was trying to create a Decoder with:

NimbusJwtDecoder jwtDecoder = JwtDecoders.fromOidcIssuerLocation(issuer);

jgrandja · 2021-04-01T09:19:38Z

Thanks for your feedback @wsaca.

This is a similar error message that @kazakovav is getting.

Is your application deployed within a container, e.g. docker image?

wsaca · 2021-04-01T13:35:58Z

@jgrandja I'm not running the app on docker, it's using JDK 15 and the configuration is not complex:

http
        .csrf()
            .disable()
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
        .authorizeRequests()
            .antMatchers("/graphql/**").authenticated()
            .and()
        .oauth2ResourceServer()
            .jwt()
                .decoder(jwtDecoder())

jgrandja · 2021-04-01T14:52:24Z

Thanks @wsaca. Ok then it looks like a JDK version incompatibility.

Can you try with JDK 11 (or older) and let me know if the problem persists.

@kazakovav Can you try as well.

wsaca · 2021-04-01T15:49:49Z

@jgrandja I tested with JDK 11 and 1.8 but Im getting the same error.

Caused by: java.lang.ClassCastException: com.nimbusds.jose.Algorithm cannot be cast to com.nimbusds.jose.JWSAlgorithm
	at org.springframework.security.oauth2.jwt.JwtDecoderProviderConfigurationUtils.getSignatureAlgorithms(JwtDecoderProviderConfigurationUtils.java:93) ~[spring-security-oauth2-jose-5.5.0-M3.jar:5.5.0-M3]
	at org.springframework.security.oauth2.jwt.JwtDecoders.withProviderConfiguration(JwtDecoders.java:122) ~[spring-security-oauth2-jose-5.5.0-M3.jar:5.5.0-M3]
	at org.springframework.security.oauth2.jwt.JwtDecoders.fromOidcIssuerLocation(JwtDecoders.java:66) ~[spring-security-oauth2-jose-5.5.0-M3.jar:5.5.0-M3]

Im using Spring Boot 2.5.0-M3, maybe this is not about my configuration because with Spring Boot 2.4.4 it's working.

wsaca · 2021-04-01T16:34:14Z

Algorithm is not an interface or abstract class, nimbus is creating the Algorithm using this method:

    public static Algorithm parse(String s) {
        return s == null ? null : new Algorithm(s);
    }

This line cant be parsed on JwtDecoderProviderConfigurationUtils.getSignatureAlgorithms(...):

jwsAlgorithms.add((JWSAlgorithm)jwk.getAlgorithm());

I think this code should be:

jwsAlgorithms.add(JWSAlgorithm.parse(jwk.getAlgorithm().getName()));

or work with the class Algorithm:

Set<Algorithm> jwsAlgorithms = new HashSet<>();

jgrandja · 2021-04-05T14:19:19Z

@wsaca Can you please put together a minimal reproducible sample and I'll take a look.

jgrandja · 2021-04-05T14:23:41Z

@wsaca Also, please log a new ticket as your issue is similar BUT different than this issue.

This issue is related to OAuth2UserRequest

java.lang.ClassCastException: class org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest cannot be cast to class org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest (org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest and org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest are in unnamed module of loader 'app')

And your issue is related to JwtDecoderProviderConfigurationUtils

XhstormR · 2021-04-11T03:39:54Z

I have the same problem, delegate OidcUserService works fine in Spring Boot 2.3.7.Release, but an error occurs after upgrading to version 2.4.4.

Error log:

2021-04-11 11:28:04.668 ERROR 236 --- [nio-8081-exec-6] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception

java.lang.ClassCastException: class org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest cannot be cast to class org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest (org.springframework.security.oauth2.client.userinfo.OAuth2UserRequest and org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest are in unnamed module of loader 'app')
	at org.springframework.security.oauth2.client.authentication.OAuth2LoginAuthenticationProvider.authenticate(OAuth2LoginAuthenticationProvider.java:117) ~[spring-security-oauth2-client-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182) ~[spring-security-core-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.oauth2.client.web.OAuth2LoginAuthenticationFilter.attemptAuthentication(OAuth2LoginAuthenticationFilter.java:192) ~[spring-security-oauth2-client-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:222) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter.doFilterInternal(OAuth2AuthorizationRequestRedirectFilter.java:178) ~[spring-security-oauth2-client-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestRedirectFilter.doFilterInternal(OAuth2AuthorizationRequestRedirectFilter.java:178) ~[spring-security-oauth2-client-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:117) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183) ~[spring-security-web-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.3.5.jar:5.3.5]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.5.jar:5.3.5]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) ~[na:na]
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) ~[na:na]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-9.0.44.jar:9.0.44]
	at java.base/java.lang.Thread.run(Thread.java:832) ~[na:na]

This is my minimum reproduction sample. login.zip

jgrandja · 2021-04-13T13:49:03Z

@XhstormR Thanks for providing a sample.

I got a different error on my end:

java.lang.NoSuchMethodError: com.nimbusds.jose.Header.toJSONObject()Ljava/util/Map;
	at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:155) ~[spring-security-oauth2-jose-5.5.0-SNAPSHOT.jar:5.5.0-SNAPSHOT]

The reason for this is because there is a binary incompatibility with the Nimbus dependency managed by Spring Boot and Spring Security.

Spring Boot 2.4.4 manages Spring Security 5.4.5, however, in your gradle.properties you specified spring-security.version=5.5.0-SNAPSHOT overriding the supported version. Removing this override works on my end.

jgrandja · 2021-04-13T13:55:45Z

Related gh-9399 gh-9400

jgrandja · 2021-04-13T14:11:46Z

@kazakovav @wsaca See comment.

Recently there was a binary incompatibility (see gh-9399 gh-9400) issue with the Nimbus dependency managed by Spring Boot and Spring Security. Please ensure your application is using supported release versions, e.g. Spring Boot 2.4.4. Snapshot versions change so things might stop working one day and another day it's working again.

I believe if you try with Spring Boot 2.4.4 it will work. But make sure you don't override the Spring Security version, it should use Spring Security 5.4.5, which is managed by Spring Boot 2.4.4.

I'm going to close this issue as resolved. If you're still experiencing the issue we can reopen.

axel-hk · 2022-06-30T16:46:15Z

@jgrandja I try to run the example of @kazakovav, but the same issue displayed with Spring Boot 2.4.4 and newest version, with older version like 2.3.9.REALESE app can't even start

stingion · 2022-08-24T20:02:57Z

@axel-hk

To start change demo-keycloak-oauth pom.xml:

 <dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-oauth2-client</artifactId>          
 </dependency>

to

 <dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-oauth2-client</artifactId>
     <exclusions>
         <exclusion>
             <groupId>com.nimbusds</groupId>
             <artifactId>oauth2-oidc-sdk</artifactId>
         </exclusion>
    </exclusions>
</dependency>

<dependency>
    <groupId>com.nimbusds</groupId>
    <artifactId>oauth2-oidc-sdk</artifactId>
    <version>9.22</version>
</dependency>

jgrandja self-assigned this Mar 19, 2021

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Mar 22, 2021

jgrandja added status: waiting-for-feedback We need additional information before we can continue and removed status: feedback-provided Feedback has been provided labels Mar 26, 2021

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Mar 31, 2021

jgrandja added status: waiting-for-feedback We need additional information before we can continue and removed status: feedback-provided Feedback has been provided labels Apr 1, 2021

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Apr 1, 2021

jgrandja added status: waiting-for-feedback We need additional information before we can continue and removed status: feedback-provided Feedback has been provided labels Apr 1, 2021

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Apr 1, 2021

jgrandja removed the status: feedback-provided Feedback has been provided label Apr 5, 2021

jgrandja added the status: waiting-for-feedback We need additional information before we can continue label Apr 5, 2021

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Apr 11, 2021

jgrandja removed the status: feedback-provided Feedback has been provided label Apr 13, 2021

jgrandja closed this as completed Apr 13, 2021

jgrandja added the status: duplicate A duplicate of another issue label Apr 13, 2021

wsaca mentioned this issue Apr 19, 2021

JwtDecoders from issuer uri produces ClassCastException #9651

Closed

RobertHeim mentioned this issue Apr 20, 2021

2.5.0-RC1 JWSAlgorithm are in unnamed module of loader 'app' spring-projects/spring-boot#26170

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ClassCastException when use oidcUserService delegate #9512

ClassCastException when use oidcUserService delegate #9512

kazakovav commented Mar 19, 2021

jgrandja commented Mar 19, 2021

kazakovav commented Mar 22, 2021 •

edited

Loading

jgrandja commented Mar 26, 2021 •

edited

Loading

wsaca commented Mar 31, 2021

jgrandja commented Apr 1, 2021

wsaca commented Apr 1, 2021

jgrandja commented Apr 1, 2021

wsaca commented Apr 1, 2021

wsaca commented Apr 1, 2021

jgrandja commented Apr 5, 2021

jgrandja commented Apr 5, 2021 •

edited

Loading

XhstormR commented Apr 11, 2021

jgrandja commented Apr 13, 2021

jgrandja commented Apr 13, 2021

jgrandja commented Apr 13, 2021

axel-hk commented Jun 30, 2022

stingion commented Aug 24, 2022 •

edited

Loading

ClassCastException when use oidcUserService delegate #9512

ClassCastException when use oidcUserService delegate #9512

Comments

kazakovav commented Mar 19, 2021

jgrandja commented Mar 19, 2021

kazakovav commented Mar 22, 2021 • edited Loading

jgrandja commented Mar 26, 2021 • edited Loading

wsaca commented Mar 31, 2021

jgrandja commented Apr 1, 2021

wsaca commented Apr 1, 2021

jgrandja commented Apr 1, 2021

wsaca commented Apr 1, 2021

wsaca commented Apr 1, 2021

jgrandja commented Apr 5, 2021

jgrandja commented Apr 5, 2021 • edited Loading

XhstormR commented Apr 11, 2021

jgrandja commented Apr 13, 2021

jgrandja commented Apr 13, 2021

jgrandja commented Apr 13, 2021

axel-hk commented Jun 30, 2022

stingion commented Aug 24, 2022 • edited Loading

kazakovav commented Mar 22, 2021 •

edited

Loading

jgrandja commented Mar 26, 2021 •

edited

Loading

jgrandja commented Apr 5, 2021 •

edited

Loading

stingion commented Aug 24, 2022 •

edited

Loading