Error on Spring Authorization server when issuing Id token after migrating from Spring boot 4.0.5 -> 4.0.7

[pzgadzaj]

Describe the bug
Migrate a service from spring boot 4.0.5 to 4.0.7 which

• acts as Authorization server
• acts as Resource server (user authenticates using OIDC within external IDP)

To Reproduce

1. Configure service which uses spring boot 4.0.7 to act as:

• authorization server
• resource server

2. Log in using OIDC federation
3. Authenticated session is established with the service, based on IdToken retrieved from external IDP
4. Hit /oauth2/authorize endpoint to retrieve "Authorization Server" issued IdToken/AccessToken

Exception is thrown (details, see screenshot):
java.lang.IllegalArgumentException: authenticationTime cannot be null
at org.springframework.util.Assert.notNull(Assert.java:182)
at org.springframework.security.oauth2.server.authorization.token.JwtGenerator.getAuthenticationTime(JwtGenerator.java:237)
at org.springframework.security.oauth2.server.authorization.token.JwtGenerator.generate(JwtGenerator.java:147)
at org.springframework.security.oauth2.server.authorization.token.JwtGenerator.generate(JwtGenerator.java:66)
at org.springframework.security.oauth2.server.authorization.token.DelegatingOAuth2TokenGenerator.generate(DelegatingOAuth2TokenGenerator.java:60)
at org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationProvider.authenticate(OAuth2AuthorizationCodeAuthenticationProvider.java:274)

Expected behavior
No exception is thrown,

[re1709]

Possibly same issue: #19140

There is an outstanding pull request on that issue that i think will solve this, considering the fact you're missing the authority FactorGrantedAuthority.AUTHORIZATION_CODE_AUTHORITY when user authenticates using OIDC within external IDP.

There is a mitigation on that issue you could try in the mean time.