Logging in via oauth2 using redis session throws jackson error

[msosa]

Describe the bug
When I attempt to login via oauth 2 using redis sessions I get this jackson error

org.springframework.data.redis.serializer.SerializationException: Could not read JSON:Could not resolve type id 'java.net.URL' as a subtype of `java.lang.Object`: Configured `PolymorphicTypeValidator` (of type `tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator`) denied resolution
 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); byte offset: #1988] (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]->org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken["principal"]->org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser["authorities"]->java.util.HashSet[0]->org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority["idToken"]->org.springframework.security.oauth2.core.oidc.OidcIdToken["claims"]->java.util.LinkedHashMap["iss"])

the error location of the json in redis appears to be here

          "iss": [
            "java.net.URL",
            "https://accounts.google.com"
          ],

I am using the documentation code for 4.0.1-SNAPSHOT

Sample

Here is a link to the sample. To set it up add your oauth2 details to application.yml, start up spring boot and attempt to login

[bilak]

I'm facing the same issue currently. Were you able to fix/workaround it?

I have config like this:

@Configuration
@EnableRedisIndexedWebSession
public class RedisSessionConfig implements BeanClassLoaderAware {

    private ClassLoader loader;

    @Bean
    RedisSerializer<Object> springSessionDefaultRedisSerializer() {
        return new GenericJacksonJsonRedisSerializer(objectMapper());
    }

    private ObjectMapper objectMapper() {
        return JsonMapper.builder()
            .addModules(SecurityJacksonModules.getModules(this.loader))
            .build();
    }

    @Override
    public void setBeanClassLoader(final ClassLoader classLoader) {
        this.loader = classLoader;
    }

    @Bean
    ConfigureReactiveRedisAction configureRedisAction(final Environment environment) {
        if (environment.matchesProfiles("dragonfly")) {
            return new DragonflyConfigureNotifyKeyspaceEventsAction();
        } else {
            return new ConfigureNotifyKeyspaceEventsReactiveAction();
        }
    }

}

[bilak]

Hmm and quickly found a solution adding BasicPolymorphicTypeValidator

private ObjectMapper objectMapper() {
        final BasicPolymorphicTypeValidator.Builder typeValidatorBuilder =
            BasicPolymorphicTypeValidator.builder()
                .allowIfSubType(Object.class);
        
        return JsonMapper.builder()
            .addModules(SecurityJacksonModules.getModules(this.loader, typeValidatorBuilder))
            .build();
    }