From 537c80dbb920d445746e65815f19975b33878b5e Mon Sep 17 00:00:00 2001 From: JaeHyunAn <98042706+yyuneu@users.noreply.github.com> Date: Tue, 8 Sep 2026 16:46:31 +0900 Subject: [PATCH] Honor authorities-claim-delimiter when set on its own See gh-51619 Signed-off-by: JaeHyunAn <98042706+yyuneu@users.noreply.github.com> --- .../ReactiveOAuth2ResourceServerJwtConfiguration.java | 5 +++++ .../servlet/OAuth2ResourceServerJwtConfiguration.java | 5 +++++ .../JwtConverterCustomizationsArgumentsProvider.java | 4 ++-- ...ReactiveOAuth2ResourceServerAutoConfigurationTests.java | 7 +++++++ .../OAuth2ResourceServerAutoConfigurationTests.java | 7 +++++++ 5 files changed, 26 insertions(+), 2 deletions(-) diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerJwtConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerJwtConfiguration.java index 9b4adc17474..822ee407c25 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerJwtConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerJwtConfiguration.java @@ -265,6 +265,11 @@ class ReactiveOAuth2ResourceServerJwtConfiguration { } + @ConditionalOnProperty("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter") + static class OnAuthoritiesClaimDelimiter { + + } + } } diff --git a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java index 2f9e477d8db..2ee7fdb4a6c 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java +++ b/module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerJwtConfiguration.java @@ -257,6 +257,11 @@ class OAuth2ResourceServerJwtConfiguration { } + @ConditionalOnProperty("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter") + static class OnAuthoritiesClaimDelimiter { + + } + } } diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java index 23f56974a46..a0df6bb7069 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java @@ -53,7 +53,7 @@ public final class JwtConverterCustomizationsArgumentsProvider implements Argume String principalClaimProperty = "spring.security.oauth2.resourceserver.jwt.principal-claim-name=" + customPrincipalClaim; String[] customPrefixProps = { jwkSetUriProperty, authorityPrefixProperty }; - String[] customDelimiterProps = { jwkSetUriProperty, authorityPrefixProperty, authoritiesDelimiterProperty }; + String[] customDelimiterProps = { jwkSetUriProperty, authoritiesDelimiterProperty }; String[] customAuthoritiesClaimProps = { jwkSetUriProperty, authoritiesClaimProperty }; String[] customPrincipalClaimProps = { jwkSetUriProperty, principalClaimProperty }; String[] allJwtConverterProps = { jwkSetUriProperty, authorityPrefixProperty, authoritiesDelimiterProperty, @@ -84,7 +84,7 @@ public final class JwtConverterCustomizationsArgumentsProvider implements Argume Arguments.of(Named.named("Custom prefix for GrantedAuthority", customPrefixProps), noAuthoritiesCustomizationsJwt, subjectValue, customPrefixAuthorities), Arguments.of(Named.named("Custom delimiter for JWT scopes", customDelimiterProps), - customAuthoritiesDelimiterJwt, subjectValue, customPrefixAuthorities), + customAuthoritiesDelimiterJwt, subjectValue, defaultPrefixAuthorities), Arguments.of(Named.named("Custom JWT authority claim name", customAuthoritiesClaimProps), customAuthoritiesClaimJwt, subjectValue, defaultPrefixAuthorities), Arguments.of(Named.named("Custom JWT principal claim name", customPrincipalClaimProps), diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java index ab737ca6bd7..44706ef0277 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java @@ -701,6 +701,13 @@ class ReactiveOAuth2ResourceServerAutoConfigurationTests { .run((context) -> assertThat(context).hasSingleBean(ReactiveJwtAuthenticationConverter.class)); } + @Test + void shouldConfigureJwtConverterIfAuthoritiesClaimDelimiterIsSet() { + this.contextRunner + .withPropertyValues("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter=dummy") + .run((context) -> assertThat(context).hasSingleBean(ReactiveJwtAuthenticationConverter.class)); + } + @ParameterizedTest(name = "{0}") @ArgumentsSource(JwtConverterCustomizationsArgumentsProvider.class) void autoConfigurationShouldConfigureResourceServerWithJwtConverterCustomizations(String[] properties, Jwt jwt, diff --git a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java index b6e472d2961..876964d8202 100644 --- a/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java +++ b/module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/OAuth2ResourceServerAutoConfigurationTests.java @@ -738,6 +738,13 @@ class OAuth2ResourceServerAutoConfigurationTests { .run((context) -> assertThat(context).hasSingleBean(JwtAuthenticationConverter.class)); } + @Test + void shouldConfigureJwtConverterIfAuthoritiesClaimDelimiterIsSet() { + this.contextRunner + .withPropertyValues("spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter=dummy") + .run((context) -> assertThat(context).hasSingleBean(JwtAuthenticationConverter.class)); + } + @Test void jwtAuthenticationConverterByJwtConfigIsConditionalOnMissingBean() { String propertiesPrincipalClaim = "principal_from_properties";