Ytukyg

Oauth2 and Redis will not play well together. As soon as I'm enabling Spring Session, two session IDs are created after I have been authenticated (OIDC) and sent back to the application — one JSESSIONID from Redis and another from Spring Security Oauth. As soon as I'm disabling Redis/Spring Session, everything works very well — on Jboss as well as Jetty.

We use Redis to store our sessions so the application can be stateless. For this we use spring-session-data-redis. With Spring Session and spring-security-saml2-core it works just fine. We are now testing authentication with OIDC.

I have found some suggestions in this forum and tried several of them, for instance changed from RequestContextListener to RequestContextFilter and configured HttpSessionIdResolver. Unfortunately with no luck.

Spring Data Redis version: 2.1.2
Spring Security version: 5.1.2
Spring Session Data version: 2.1.1
Jedis version: 2.9.0
Spring Security Oauth2 version: 2.3.4

We have not yet got rid of all our XML config since we're having a complex authentication model, so I have used XML configuration in order to define the Oauth2 components.

applicationContext-security.xml:

<s:http entry-point-ref="delegatingEntryPoint" use-expressions="true">

  […]

  <s:custom-filter before="PRE_AUTH_FILTER" ref="oAuth2ClientContextFilter" /> 

  <s:custom-filter before="SERVLET_API_SUPPORT_FILTER" ref="dataportenConnectFilter" />

</s:http>



<oauth:client id="oAuth2ClientContextFilter" redirect-strategy-ref="saveRequestRedirectStrategy" />



<oauth:rest-template id="restTemplate"  resource="dataporten" />



<oauth:resource id="dataporten" type="authorization_code"

  […]

/>

AbstractAuthenticationConfig:

public abstract class AbstractAuthenticationConfig implements AuthenticationConfig {

  […]

  @Bean

  public DataportenConnectFilter dataportenConnectFilter() {

    DataportenConnectFilter filter = new DataportenConnectFilter("/oauth/login");

    filter.setRestTemplate(restTemplate);

    return filter;

  }





  @Bean

  public OAuth2AuthenticationEntryPoint auth2AuthenticationEntryPoint() {

    return new OAuth2AuthenticationEntryPoint();

  }

}

NettskjemaWebInitializer:

public class NettskjemaWebInitializer implements WebApplicationInitializer {



  @Override

  public void onStartup(final ServletContext container) throws ServletException {

    WebApplicationContext applicationContext = getApplicationContext();

    configureServletContext(container, applicationContext);

    addServlets(container);

    addFilters(container, applicationContext);

    addListeners(container, applicationContext);

  }



  private void addFilters(final ServletContext container, final WebApplicationContext applicationContext) {



    boolean usingRedis = env.acceptsProfiles("redis-sessions");

    if (usingRedis) {

        container.addFilter("springSessionRepositoryFilter", DelegatingFilterProxy.class)

                .addMappingForUrlPatterns(null, false, "/*");

    }



    container.addFilter("oAuth2ClientContextFilter", new OAuth2ClientContextFilter());



    container.addFilter("springSecurityFilterChain", DelegatingFilterProxy.class)

            .addMappingForUrlPatterns(null, false, "/*");



    ExcludePathOpenSessionInViewFilter excludePathOpenSessionInViewFilter =

            new ExcludePathOpenSessionInViewFilter("/static");

    container.addFilter("excludePathOpenSessionInViewFilter", excludePathOpenSessionInViewFilter)

            .addMappingForUrlPatterns(null, false, "/*");



    // Caused: IllegalStateException: No thread-bound request found …

    // container.addFilter("requestContextFilter", RequestContextFilter.class);

}

The configured DataportenConnectFilter in applicationContext-security.xml its just extending the OAuth2ClientAuthenticationProcessingFilter.

Adding the following does not seem to help either:

@Bean

public HttpSessionIdResolver httpSessionIdResolver() {

    return HeaderHttpSessionIdResolver.xAuthToken();

}

I also tried to remove all the other authentication providers (SAML, LDAP etc.) and use Java config instead of XML, i.e. creating a SecurityConfig class annotated with @EnableWebSecurity, but with no luck. I still get two session cookies.

Most of my work is based on the following guide:
https://www.baeldung.com/spring-security-openid-connect