I have a spring boot application running on spring boot 2.7.18. For authentication purposes I am using the com.nimbusds.oauth2.sdk
version 8.4.2.
I have an interface called AuthServiceAgent
.
public interface CurityAuthServiceAgent {
/**
* Get the authorized {@link AuthId} given the supplied credentials.
*/
Single<AuthId> getAuthorizedUser(String token);
...
}
The implementation of this interface looks like this:
@Component
@Lazy
@Qualifier("regular")
public class AuthServiceAgentImpl implements AuthServiceAgent {
...
@Qualifier("CommonAsyncHttpExecutor")
@Autowired
private AsyncHttpExecutor asyncHttpExecutor;
@Value("${auth.issuer-url}")
private Issuer issuerUrl;
@Value("${auth.scope}")
private String requiredScope;
...
@Lazy
@Autowired
private AuthorizationServerMetadata authorizationServerMetadata;
@Bean
@Lazy
private AuthorizationServerMetadata authorizationServerMetadata() {
return getAuthorizationServerMetadata().blockingGet();
}
private Single<AuthorizationServerMetadata> getAuthorizationServerMetadata() {
// Connect to auth server and fetch meta data (e.g. endpoint URIs)
logger.info("Fetching authorization server metadata from {}", issuerUrl.getValue());
var request = new OIDCProviderConfigurationRequest(issuerUrl);
var httpRequest = request.toHTTPRequest();
httpRequest.setEntityContentType(ContentType.APPLICATION_JSON);
return asyncHttpExecutor.execute("getauthservermetadata", toAhcRequest(httpRequest)).map(response -> {
HTTPResponse httpResponse = toHttpResponse(response);
return OIDCProviderMetadata.parse(httpResponse.getContentAsJSONObject());
});
}
@Override
public Single<AuthId> getAuthorizedUser(String token) {
//Error happens here
TokenIntrospectionRequest request =
new TokenIntrospectionRequest(authorizationServerMetadata.getIntrospectionEndpointURI(),
clientAuthentication, new BearerAccessToken(token));
...
When I add a second implementation of the interface AuthServiceAgent
@Component
@Lazy
@Qualifier("other")
public class AuthServiceAgentImplOther implements AuthServiceAgent {
@Qualifier("CommonAsyncHttpExecutor")
@Autowired
private AsyncHttpExecutor asyncHttpExecutor;
@Value("${auth.issuer-url-other}")
private Issuer issuerUrlZiklo;
@Value("${auth.scope}")
private String requiredScope;
...
@Lazy
@Autowired
private AuthorizationServerMetadata authorizationServerMetadata;
//The rest is the same as "regular" implementation
I get an error when attempting to perform a token introspection.
The error I get when debugging this line in the code
TokenIntrospectionRequest request = new TokenIntrospectionRequest(authorizationServerMetadata.getIntrospectionEndpointURI(),
clientAuthentication, new BearerAccessToken(token));
is this
org.springframework.beans.factory.BeanCreationException' exception.
Cannot evaluate com.nimbusds.oauth2.sdk.as.AuthorizationServerMetadata$$EnhancerBySpringCGLIB$$fd62187.toString()
Removing either one of the implementations makes everything work nicely. A guess is that the application can't handle AuthorizationServerMetaData
, but this is from the nimbus oauth2 library, and not my code. I am trying to find a way for another class to autowire and use either one of the implementations based on a condition.
@Component("MainAuthorizer")
@Lazy
public class Authorizer implements Authorizer<RequestContext> {
@Qualifier("regular")
@Autowired
private AuthServiceAgent serviceAgentRegular;
@Qualifier("other")
@Autowired
private AuthServiceAgent serviceAgentOther;
...
This works fine, until either one of the implementations need to do the introspection.