Skip to content

AuthorityAuthorizationManager incorrectly compares GrantedAuthority #10566

@legas1

Description

@legas1

Describe the bug
Hi, in commit 86c24da there was a slight change in comparison of allowed authorities to endpoints. However in our use case this was huge breaking change.

Lines:
86c24da#diff-8c62a1a24d0860e1da929cdb7cdbf50a8e7daa565fd03f05673299917891f33bR40
86c24da#diff-eb4576063aa24fd635f700152f04a2590973ce56a20899414957e53a2584da74R38

In our Kotlin environment, we implement enum which implements GrantedAuthority and custom Authentication class, when this enum reaches ReactiveAuthorizationManager check method, its compared to SimpleGrantedAuthority (class implementing GrantedAuthority, breaking change from changes above) instead of underlying string authority, which results in non equality and thus denying access to endpoint.

To Reproduce

  1. Have custom implementation of AuthenticationManager which have custom Authentication implementation and custom GrantedAuthority implementation.
  2. Attempt to use protected endpoint with some authority.
  3. Access denied.

Expected behavior
Allow access to given endpoint.

Sample
https://github.com/legas1/ss.grantedauthority.demo

Does it make sense or do you need more clarification? Or I am completely wrong about my understanding of upper changes? The solution in my opinion would be to revert those changes or maybe adjust equal method of SimpleGrantedAuthority to count with GrantedAuthority interface.

Cheers, Daniel

Metadata

Metadata

Labels

in: coreAn issue in spring-security-corestatus: backportedAn issue that has been backported to maintenance branchestype: bugA general bug

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions