Security configurations causing StackOverflowError

[arahlf]

Using Spring Boot to configure a server application with a PreAuthenticatedAuthenticationProvider, but when running it I end up with a StackOverflowError. An example project that reproduces the issue (run the tests) is here: https://github.com/arahlf/StackOverflowErrorExample

The end of the stack trace looks like:

java.lang.StackOverflowError: null
	at java.lang.Exception.<init>(Exception.java:102) ~[na:1.8.0_172]
	at java.lang.ReflectiveOperationException.<init>(ReflectiveOperationException.java:89) ~[na:1.8.0_172]
	at java.lang.reflect.InvocationTargetException.<init>(InvocationTargetException.java:72) ~[na:1.8.0_172]
	at sun.reflect.GeneratedMethodAccessor27.invoke(Unknown Source) ~[na:na]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_172]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_172]
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344) ~[spring-aop-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:205) ~[spring-aop-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at com.sun.proxy.$Proxy79.authenticate(Unknown Source) ~[na:na]
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:195) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$AuthenticationManagerDelegator.authenticate(WebSecurityConfigurerAdapter.java:501) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at sun.reflect.GeneratedMethodAccessor27.invoke(Unknown Source) ~[na:na]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_172]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_172]
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344) ~[spring-aop-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:205) ~[spring-aop-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at com.sun.proxy.$Proxy79.authenticate(Unknown Source) ~[na:na]
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:195) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]

Any ideas? Did I just configure something incorrectly?

Thanks

[snicoll]

@arahlf thanks for the sample. I don't see anything obvious that indicates Spring Boot would be responsible for the cycle here. I had a look to the sample and suspected the AuthenticationManager field injection in the web config to be the culprit but it wasn't. I am afraid I can't move this issue to the Spring Security project. Can you please create it there and add a reference to this issue so that we can follow what is going on?

If it turns out there is an issue in Spring Boot, we can reopen this one.