OAuth2AuthenticationExceptionMixin doesn't work in JDK 17

[EvgeniGordeev]

Describe the bug
With Redis session enabled, GenericJackson2JsonRedisSerializer based on ObjectMapper with OAuth2ClientJackson2Module an exception is thrown in JDK 17 while serializing:

com.fasterxml.jackson.databind.exc.InvalidDefinitionException: Invalid type definition for type `org.springframework.security.oauth2.core.OAuth2AuthenticationException`: Failed to construct BeanSerializer for [simple type, class org.springframework.security.oauth2.core.OAuth2AuthenticationException]: (java.lang.IllegalArgumentException) Failed to call `setAccess()` on Field 'detailMessage' (of class `java.lang.Throwable`) due to `java.lang.reflect.InaccessibleObjectException`, problem: Unable to make field private java.lang.String java.lang.Throwable.detailMessage accessible: module java.base does not "opens java.lang" to unnamed module @5aebe890

To Reproduce

Spring boot 2.7.2:

@EnableRedisRepositories
@Configuration
public class RedisSessionConfig implements BeanClassLoaderAware {
    private ClassLoader loader;

    /**
     * Workaround for https://github.com/spring-projects/spring-session/issues/124.
     */
    @Bean
    public ConfigureRedisAction configureRedisAction() {
        return ConfigureRedisAction.NO_OP;
    }

    @Bean
    public RedisSerializer<Object> springSessionDefaultRedisSerializer() {
        return new GenericJackson2JsonRedisSerializer(objectMapper());
    }

    private ObjectMapper objectMapper() {
        ObjectMapper om = new ObjectMapper();
        om.activateDefaultTyping(om.getPolymorphicTypeValidator(), ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
        om.registerModules(SecurityJackson2Modules.getModules(this.loader));
        om.registerModule(new OidcSecurityUserModule());
        return om;
    }

    @Override
    public void setBeanClassLoader(ClassLoader classLoader) {
        this.loader = classLoader;
    }

Expected behavior
OAuth2AuthenticationException object is successfully serialized in JDK 17.

Workaround

VM option --add-opens java.base/java.lang=ALL-UNNAMED as usual.

[jzheaux]

Hi, @EvgeniGordeev, I wonder if this is related to FasterXML/jackson-databind#3275. Have you already tried using the latest Jackson dependencies to see if that resolves the issue? It appears that the above issue was fixed in 2.13.4, though Boot 2.7.2 uses 2.13.3.

[EvgeniGordeev]

@jzheaux Checked it in SB 2.7.4 - the issue is still there.

[chrisrhut]

@jzheaux here's a rudimentary test that shows off the issue with Spring Boot 2.7.4 and Jackson 2.13.4: https://github.com/chrisrhut/spring-security-11893

As mentioned by @EvgeniGordeev it can be fixed by adding the --add-opens VM argument.

[jzheaux]

Since the exception is complaining about code controlled by Jackson, it seems to me this would need to be addressed in Jackson.

Is there some way that Spring Security is using Jackson incorrectly? If not, please open a ticket with Jackson. Feel free to add here a link to that ticket.