Spring Security Authorization Server is missing the Jackson Mixin for FactorGrantedAuthority

[k6leung]

Describe the bug
JdbcOAuth2AuthorizationService fails to deserialize FactorGrantedAuthority because of missing Jackson mixin.

To Reproduce

1. Setup Spring Security Authorization Server to use JDBC
2. Setup Cloud Gatway with OAuth2 Client token relay
3. Create an API
4. Login
5. Calls the API through cloud gateway

Expected behavior
One should be able to call the API successfully.

Sample

https://github.com/k6leung/MongoAuthServerTest

Reports that include a sample will take priority over reports that do not.
At times, we may require a sample, so it is good to try and include a sample up front.

[k6leung]

I made the following mixin and module, added to the project and it worked:

The mixin:

@JsonTypeInfo(
        use = JsonTypeInfo.Id.CLASS
)
@JsonAutoDetect(
        fieldVisibility = JsonAutoDetect.Visibility.NONE,
        getterVisibility = JsonAutoDetect.Visibility.PUBLIC_ONLY,
        isGetterVisibility = JsonAutoDetect.Visibility.NONE
)
public abstract class FactorGrantedAuthorityMixin {
    @JsonCreator
    public FactorGrantedAuthorityMixin(@JsonProperty("authority") String role, @JsonProperty("issuedAt") Instant issuedAt) {

    }
}

The module that sets up the mixin:

public class FactorGrantedAuthorityJacksonModule extends SecurityJacksonModule {

    public FactorGrantedAuthorityJacksonModule() {
        super(FactorGrantedAuthorityJacksonModule.class.getName(), new Version(1, 0, 0, (String)null, (String)null, (String)null));
    }

    @Override
    public void configurePolymorphicTypeValidator(BasicPolymorphicTypeValidator.Builder builder) {
        builder.allowIfSubType(FactorGrantedAuthority.class);
    }

    public void setupModule(JacksonModule.SetupContext context) {
        context.setMixIn(FactorGrantedAuthority.class, FactorGrantedAuthorityMixin.class);
    }
}

[hqqw2h-lgtm]

I'd like to work on this. Will add the missing Jackson Mixin for FactorGrantedAuthority.

[jyx-07]

Hi, I'd like to work on this issue. I plan to add the missing Jackson mixin for FactorGrantedAuthority along with tests. Is it still available?

[jyx-07]

I dug into this and found that FactorGrantedAuthorityMixin already exists and is already registered in both CoreJackson2Module and CoreJacksonModule — it was added together with FactorGrantedAuthority itself, before this issue was filed. I verified this by round-tripping a UsernamePasswordAuthenticationToken whose authorities include a FactorGrantedAuthority through the exact ObjectMapper/JsonMapper setup JdbcOAuth2AuthorizationService builds internally — it passes on current main.

So rather than add a duplicate mixin, I opened #19594 with a regression test to lock in this already-fixed behavior and catch any future regression. If you're still hitting this, it's likely against a release that predates the mixin being added — could you confirm which spring-security version you're on?

Thanks again for the detailed report and validated workaround, @k6leung.