One-time token login does not set authentication details, and authenticationDetailsSource has no effect #19863

import org.springframework.mock.web.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
import org.springframework.security.authentication.ott.InMemoryOneTimeTokenService;
import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationProvider;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.security.web.authentication.ott.OneTimeTokenAuthenticationFilter;

public class OttDetailsRepro {

	public static void main(String[] args) throws Exception {
		var users = new InMemoryUserDetailsManager(
				User.withUsername("user").password("{noop}password").roles("USER").build());

		// Form login: details are populated
		var formLogin = new UsernamePasswordAuthenticationFilter(
				new ProviderManager(new DaoAuthenticationProvider(users)));
		formLogin.setAuthenticationSuccessHandler((request, response, authentication) ->
				System.out.println("form login     -> details = " + authentication.getDetails()));
		var formRequest = post("/login");
		formRequest.setParameter("username", "user");
		formRequest.setParameter("password", "password");
		formLogin.doFilter(formRequest, new MockHttpServletResponse(), new MockFilterChain());

		// One-time token login: details are null, even with a details source set explicitly
		var tokens = new InMemoryOneTimeTokenService();
		var ottLogin = new OneTimeTokenAuthenticationFilter();
		ottLogin.setAuthenticationManager(new ProviderManager(new OneTimeTokenAuthenticationProvider(tokens, users)));
		ottLogin.setAuthenticationDetailsSource(new WebAuthenticationDetailsSource());
		ottLogin.setAuthenticationSuccessHandler((request, response, authentication) ->
				System.out.println("one-time token -> details = " + authentication.getDetails()));
		var ottRequest = post("/login/ott");
		ottRequest.setParameter("token", tokens.generate(new GenerateOneTimeTokenRequest("user")).getTokenValue());
		ottLogin.doFilter(ottRequest, new MockHttpServletResponse(), new MockFilterChain());
	}

	private static MockHttpServletRequest post(String path) {
		var request = new MockHttpServletRequest("POST", path);
		request.setRemoteAddr("203.0.113.7");
		return request;
	}

}

static AuthenticationConverter oneTimeTokenConverterWithDetails() {
	var converter = new OneTimeTokenAuthenticationConverter();
	var detailsSource = new WebAuthenticationDetailsSource();
	return (request) -> {
		Authentication authentication = converter.convert(request);
		if (authentication instanceof OneTimeTokenAuthenticationToken token) {
			token.setDetails(detailsSource.buildDetails(request));
		}
		return authentication;
	};
}

// http.oneTimeTokenLogin((ott) -> ott.authenticationConverter(oneTimeTokenConverterWithDetails()));