Create Jackson Mixin for OneTimeTokenAuthenticationToken

Closes gh-18095

Signed-off-by: Marcus Hert da Coregio <[email protected]>

Author: marcusdacoregio

core/src/main/java/org/springframework/security/jackson2/CoreJackson2Module.java

@@ -25,6 +25,7 @@
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.RememberMeAuthenticationToken;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.User;
 
@@ -70,6 +71,7 @@ public void setupModule(SetupContext context) {
 		context.setMixInAnnotations(UsernamePasswordAuthenticationToken.class,
 				UsernamePasswordAuthenticationTokenMixin.class);
 		context.setMixInAnnotations(BadCredentialsException.class, BadCredentialsExceptionMixin.class);
+		context.setMixInAnnotations(OneTimeTokenAuthenticationToken.class, OneTimeTokenAuthenticationTokenMixin.class);
 	}
 
 }

core/src/main/java/org/springframework/security/jackson2/OneTimeTokenAuthenticationTokenMixin.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright 2004-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.jackson2;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import org.springframework.security.core.GrantedAuthority;
+
+import java.util.Collection;
+
+/**
+ * Jackson Mixin class helps in serialize/deserialize
+ * {@link org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken}.
+ *
+ * <pre>
+ *     ObjectMapper mapper = new ObjectMapper();
+ *     mapper.registerModule(new CoreJackson2Module());
+ * </pre>
+ *
+ * @author Marcus Da Coregio
+ * @since 6.5.7
+ * @see CoreJackson2Module
+ * @see SecurityJackson2Modules
+ *
+ */
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.NONE,
+		getterVisibility = JsonAutoDetect.Visibility.PUBLIC_ONLY, isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonIgnoreProperties(ignoreUnknown = true)
+abstract class OneTimeTokenAuthenticationTokenMixin {
+
+	@JsonCreator
+	OneTimeTokenAuthenticationTokenMixin(@JsonProperty("principal") Object principal,
+			@JsonProperty("authorities") Collection<? extends GrantedAuthority> authorities) {
+	}
+
+}

core/src/test/java/org/springframework/security/authentication/ott/OneTimeTokenAuthenticationTokenTests.java

@@ -0,0 +1,25 @@
+package org.springframework.security.authentication.ott;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.jackson2.SecurityJackson2Modules;
+
+import java.io.IOException;
+
+import static org.assertj.core.api.Assertions.assertThatNoException;
+
+class OneTimeTokenAuthenticationTokenTests {
+
+	// gh-18095
+	@Test
+	void shouldBeAbleToDeserializeFromJsonWithDefaultTypingActivated() throws IOException {
+		ObjectMapper mapper = new ObjectMapper();
+		mapper.registerModules(SecurityJackson2Modules.getModules(getClass().getClassLoader()));
+		OneTimeTokenAuthenticationToken oneTimeTokenAuthenticationToken = new OneTimeTokenAuthenticationToken(
+				"principal", AuthorityUtils.createAuthorityList("ROLE_USER"));
+		byte[] serialized = mapper.writeValueAsBytes(oneTimeTokenAuthenticationToken);
+		assertThatNoException().isThrownBy(() -> mapper.readValue(serialized, OneTimeTokenAuthenticationToken.class));
+	}
+
+}