Fix UsernamePasswordAuthenticationTokenDeserializer to handle customi…

…zed object mapper inclusion settings Resolves #4698
spring-projects · Jan 7, 2019 · fe40e6d · fe40e6d
1 parent 673a2ad
commit fe40e6d
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 3 deletions.
diff --git a/...rg/springframework/security/jackson2/UsernamePasswordAuthenticationTokenDeserializer.java b/...rg/springframework/security/jackson2/UsernamePasswordAuthenticationTokenDeserializer.java
@@ -41,6 +41,7 @@
  *
  * @author Jitendra Singh
  * @author Greg Turnquist
+ * @author Onur Kagan Ozcan
  * @see UsernamePasswordAuthenticationTokenMixin
  * @since 4.2
  */
@@ -69,7 +70,7 @@ public UsernamePasswordAuthenticationToken deserialize(JsonParser jp, Deserializ
 		}
 		JsonNode credentialsNode = readJsonNode(jsonNode, "credentials");
 		Object credentials;
-		if (credentialsNode.isNull()) {
+		if (credentialsNode.isNull() || credentialsNode.isMissingNode()) {
 			credentials = null;
 		} else {
 			credentials = credentialsNode.asText();
@@ -83,7 +84,7 @@ public UsernamePasswordAuthenticationToken deserialize(JsonParser jp, Deserializ
 			token = new UsernamePasswordAuthenticationToken(principal, credentials);
 		}
 		JsonNode detailsNode = readJsonNode(jsonNode, "details");
-		if (detailsNode.isNull()) {
+		if (detailsNode.isNull() || detailsNode.isMissingNode()) {
 			token.setDetails(null);
 		} else {
 			token.setDetails(detailsNode);

diff --git a/.../org/springframework/security/jackson2/UsernamePasswordAuthenticationTokenMixinTests.java b/.../org/springframework/security/jackson2/UsernamePasswordAuthenticationTokenMixinTests.java
@@ -29,11 +29,16 @@
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.User;
 
-import static org.assertj.core.api.Assertions.*;
+import static com.fasterxml.jackson.annotation.JsonInclude.Include.ALWAYS;
+import static com.fasterxml.jackson.annotation.JsonInclude.Include.NON_ABSENT;
+import static com.fasterxml.jackson.annotation.JsonInclude.Include.NON_NULL;
+import static com.fasterxml.jackson.annotation.JsonInclude.Value.construct;
+import static org.assertj.core.api.Assertions.assertThat;
 
 /**
  * @author Jitendra Singh
  * @author Greg Turnquist
+ * @author Onur Kagan Ozcan
  * @since 4.2
  */
 public class UsernamePasswordAuthenticationTokenMixinTests extends AbstractMixinTests {
@@ -163,6 +168,20 @@ public void serializingThenDeserializingWithNoCredentialsOrDetailsShouldWork() t
 		assertThat(deserialized).isEqualTo(original);
 	}
 
+	@Test
+	public void serializingThenDeserializingWithConfiguredObjectMapperShouldWork() throws IOException {
+		// given
+		this.mapper.setDefaultPropertyInclusion(construct(ALWAYS, NON_NULL)).setSerializationInclusion(NON_ABSENT);
+		UsernamePasswordAuthenticationToken original = new UsernamePasswordAuthenticationToken("Frodo", null);
+
+		// when
+		String serialized = this.mapper.writeValueAsString(original);
+		UsernamePasswordAuthenticationToken deserialized =
+				this.mapper.readValue(serialized, UsernamePasswordAuthenticationToken.class);
+
+		// then
+		assertThat(deserialized).isEqualTo(original);
+	}
 
 	private UsernamePasswordAuthenticationToken createToken() {
 		User user = createDefaultUser();