Expect AuthenticationException for invalid issuer instead of IllegalStateException
Describe the bug
Using oauth2 resource server with JWT authentication, if the client send a token with an issuer different from the one expected, the exception thrown is IllegalStateException : https://github.com/spring-projects/spring-security/blob/5fe6d9259fbee532d402a801527b7aed4d937e98/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtDecoderProviderConfigurationUtils.java#L99
The exception is never wrapped to AuthenticationException.
To Reproduce Configure oauth2 resource server and exception handling :
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
return http.csrf(AbstractHttpConfigurer::disable)
.authorizeHttpRequests(matcher -> matcher.anyRequest().authenticated())
.oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults()))
.exceptionHandling(exceptionHandling -> exceptionHandling
.authenticationEntryPoint(authenticationEntryPoint())
.accessDeniedHandler(accessDeniedHandler()))
.build();
}
@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
return (HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) -> {
LOGGER.error("Authentication failed", authException);
};
}
@Bean
public AccessDeniedHandler accessDeniedHandler() {
return (HttpServletRequest request, HttpServletResponse response,
org.springframework.security.access.AccessDeniedException accessDeniedException) -> {
LOGGER.error("Access denied", accessDeniedException);
};
}Configure JWT expected issuer uri :
spring:
security:
oauth2:
resourceserver:
jwt:
issuer-uri: https://issuer-uriSend a request with an other issuer-uri : the exception is not logged
Expected behavior
The exception is an AuthenticationException so we can catch it through httpSecurity.exceptionHandling() or Authentication events.
Source: spring-projects/spring-security