Repository navigation
OneTimeTokenAuthenticationProvider authenticate method setDetails call #16856
Description
Activity
This looks like the same root cause as #19863 : OneTimeTokenAuthenticationConverter never sets details on the
OneTimeTokenAuthenticationToken, so the provider copies null. Details are meant to describe the request
(WebAuthenticationDetails), and the user is already available as the principal, so setDetails(user) would not be the
right fix. #19863 has a reproduction and a proposed change.
Describe the bug
OneTimeTokenAuthenticationProvider does not set Principal correctly
To Reproduce
Log in via OneTimeToken with custom UserDetails with i.e. email additional field
Expected behavior
OneTimeTokenAuthenticationToken should have email field present in Principal
Bug
By my opinion bug is in line:
authenticated.setDetails(otpAuthenticationToken.getDetails());otpAuthenticationToken is unathenticated token and does not have details!
line should probably be:
authenticated.setDetails(user);