Spring Oauth2 Login not working after migrating to Spring Boot 3

Question

After migration to Spring Boot 3 from 2.7.5, when trying to login and get into infinity loop in the login screen.

After debugging we found this exception: org.springframework.security.oauth2.core.OAuth2AuthorizationException: [invalid_request] client_secret is must in DefaultAuthorizationCodeTokenResponseClient.getTokenResponse(OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest)

You can check our how is defined our SecurityFilter chain.

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
            .csrf(csrf -> csrf
                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
                    .ignoringRequestMatchers(new CsrfIgnoreRequestMatcher())
            )
            .headers(headers -> headers
                    .cacheControl().disable()
                    .frameOptions().disable()
            )
            //Access configuration
            .authorizeHttpRequests(authorizeRequest -> authorizeRequest
                    .requestMatchers(HttpMethod.OPTIONS).permitAll()
                    .requestMatchers(
                            LOGIN,
                            LOGOUT).permitAll()
            )
            .exceptionHandling(exceptionHandling -> exceptionHandling
                    .authenticationEntryPoint(new Http401UnauthorizedEntryPoint())
            )
            //######## OAUTH2-Login configuration ########
            .oauth2Login(oAuth2Login -> oAuth2Login
                    .authorizationEndpoint(authorizationEndpoint -> authorizationEndpoint
                            .baseUri(LOGIN)
                            .authorizationRequestResolver(customOAuth2AuthorizationRequestResolver)
                    )
                    .loginProcessingUrl(LOGIN)
                    .userInfoEndpoint(userInfo -> userInfo.userAuthoritiesMapper(new RoleMapper()))
            )

            .logout(logout -> logout
                    .logoutUrl(LOGOUT)
                    .invalidateHttpSession(true)
                    .logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK))
            );

    return http.build();
}

Here are our application.yaml properties for the security:

spring:
  security:
    oauth2:
      client:
        provider:
          customIdp:
            authorization-uri: https://sso.company/app/login
            jwk-set-uri: https://sso.company/oauth/nam/keys
            token-uri: https://sso.company/oauth/nam/token?resourceServer=IdentityProviderRSUE&
            user-info-uri: https://sso.company/oauth/nam/userinfo
            user-name-attribute: cn
          customIdpSso:
            authorization-uri: https://sso.company/app/login
            token-uri: ${spring.security.oauth2.client.provider.customIdp.tokenUri}
            user-info-uri: ${spring.security.oauth2.client.provider.customIdp.userInfoUri}
            user-name-attribute: ${spring.security.oauth2.client.provider.customIdp.userNameAttribute}
        registration:
          customIdp:
            authorizationGrantType: authorization_code
            clientAuthenticationMethod: basic
            client-id: custom-client-id
            clientName: Custom
            client-secret: custom-client-secret
            provider: customIdp
            redirect-uri: "{baseUrl}/api/login"
            scope: portal
          customIdpSso:
            authorizationGrantType: ${spring.security.oauth2.client.registration.customIdp.authorizationGrantType}
            clientAuthenticationMethod: ${spring.security.oauth2.client.registration.customIdp.clientAuthenticationMethod}
            clientId: ${spring.security.oauth2.client.registration.customIdp.clientId}
            clientName: ${spring.security.oauth2.client.registration.customIdp.clientName}
            client-secret: ${spring.security.oauth2.client.registration.customIdp.clientSecret}
            provider: customIdpnosso
            redirect-uri: ${spring.security.oauth2.client.registration.customIdp.redirect-uri}
            scope: ${spring.security.oauth2.client.registration.customIdp.scope}

We migrated to new Spring Boot version and stoped using WebSecurityConfigurerAdapter. If you need more information please tell us.

Answer 1

Due to https://docs.spring.io/spring-security/reference/5.8/migration/servlet/oauth2.html#_clientauthenticationmethod , the value for clientAuthenticationMethod should now be:

clientAuthenticationMethod: client_secret_basic

UPDATE : I've createdhttps://github.com/spring-projects/spring-security/issues/12585 to look into making this clearer.