Serialization and deserialization of SimpleGrantedAuthority problem in difference version of Spring Security

Viewed 1141

There are some microservices that are authenticated by Spring Security OAuth2. The version of Spring Security of some of them are 4.2.3.release and rest of them are 5.1.2.release and the Authorization Server(UAA) is secured by spring security 5.1.2.release as same as Zuul gateway as OAuth2 Client. The grant type flow is authorization_code flow. The Resource Server configuration is like this:

@Configuration
@EnableResourceServer
public class OAuth2ResourceConfig extends ResourceServerConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Bean
    @Primary
    public DefaultTokenServices tokenServices() {
        DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
        defaultTokenServices.setTokenStore(tokenStore());
        return defaultTokenServices;
    }

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenStore(tokenStore()).tokenServices(tokenServices());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/Content/**").permitAll()
                .antMatchers("/j-captcha.jpg*").permitAll()
                .antMatchers("/View/ScriptHeader/**").permitAll()
                .antMatchers("/Scripts/**").permitAll()
                .antMatchers("/download/**").permitAll()
                .antMatchers("/NewTheme/**").permitAll()
                .antMatchers("/ErrorPages/**").permitAll()
                .antMatchers("/api/**").permitAll()
                .antMatchers("/landing/**").permitAll()
                .antMatchers("/h2-console/**").permitAll()
                .antMatchers("/rest/api/**").permitAll()
                .antMatchers("/View/**").authenticated()
                .antMatchers("/rest/**").authenticated();
    }

    @Bean
    public TokenStore tokenStore() {
        return new JdbcTokenStore(dataSource);
    }

}

After authentication and auuthorization the following exception is raised in Resource Servers in which the version of spring security is 4.2.3.release

Caused by: java.io.InvalidClassException: org.springframework.security.core.authority.SimpleGrantedAuthority; local class incompatible: stream classdesc serialVersionUID = 510, local class serialVersionUID = 420 at java.io.ObjectStreamClass.initNonProxy(ObjectStreamClass.java:616) at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1630)

Due to this error, I saw the content of SimpleGrantedAuthority class in both Spring Security 5.1.2.release, there is the following line:

private static final long serialVersionUID = 510L;

and Spring Security 4.2.3.release, there is the following line:

private static final long serialVersionUID = 420L;

Because of some reasons, I am not able to upgrade the 4.2.3.release to 5.1.2.release and because of the overhead cost of UAA to retrieve the Pricipal, I do not use the RemoteTokenServices instead of DefaultTokenServices.

How do I fix my problem?

Totally, what is standard way to overcome this problem?

0 Answers
Related