Anthony Stirling 90bda6b4b4 fix: User principal was discarded by the resource server re-authentication ...

The saas chain authenticates bearer requests twice:
SupabaseAuthenticationFilter builds an EnhancedJwtAuthenticationToken
with the resolved User principal, but BearerTokenAuthenticationFilter
(oauth2ResourceServer) then re-authenticates the same token through the
static toAuthentication converter and overwrites the SecurityContext
with a token whose principal is the raw Jwt - so storage endpoints kept
returning 401 "Unsupported user principal" despite the principal fix.

Carry the User across in the converter: when the context already holds
an EnhancedJwtAuthenticationToken for the same subject with a User
principal, attach that User to the converter-built token. No extra DB
lookups; anonymous sessions and API-key auth unchanged. Covered by new
unit tests (carry, no-context, subject mismatch).

2026-06-10 14:37:12 +01:00

..

src

fix: User principal was discarded by the resource server re-authentication

2026-06-10 14:37:12 +01:00

build.gradle

SaaS Consolidation (#6384)

2026-05-21 16:05:35 +01:00

LICENSE

SaaS Consolidation (#6384)

2026-05-21 16:05:35 +01:00