Spring OAuth2 Resource Server - user-name-attribute not reflected in SecurityContextHolder

[zerkowsm]

Summary

user-name-attribute not reflected in SecurityContextHolder. This is the follow up on https://stackoverflow.com/questions/59410641/spring-oauth2-resource-server-user-name-attribute-not-reflected-in-securitycon

Actual Behavior

JwtAuthenticationConverter has

	@Override
	public final AbstractAuthenticationToken convert(Jwt jwt) {
		Collection<GrantedAuthority> authorities = extractAuthorities(jwt);
		return new JwtAuthenticationToken(jwt, authorities);
	}

where:

	public JwtAuthenticationToken(Jwt jwt, Collection<? extends GrantedAuthority> authorities) {
		super(jwt, authorities);
		this.setAuthenticated(true);
		**this.name = jwt.getSubject();**
	}

Expected Behavior

JwtAuthenticationConverter convert method if there is userNameAttribute set should return new JwtAuthenticationToken(jwt, authorities, userNameAttribute)

where

	public JwtAuthenticationToken(Jwt jwt, Collection<? extends GrantedAuthority> authorities, String name) {
		super(jwt, authorities);
		this.setAuthenticated(true);
		**this.name = name;**
	}

Version

spring-security-oauth2-resource-server-5.2.1.RELEASE (Spring Boot 2.2.2.RELEASE)

[jzheaux]

Thanks for the report, @zerkowsm. I responded via the SO ticket since I don't believe this to be a bug; however, feel free to comment further if you feel there's more to discuss.

[zerkowsm]

Thanks, I do not know where should I reply but SO has limits for comments so I will do that here.
Yes, it works as you wrote only casting to JwtAuthenticationToken is missing. But isn’t it rather kind of workaround with constructing ‘the same’ object twice… still – works, thanks!
I’m just wondering if instead of having it hard coded it wouldn't be nice to have it configurable. I know that there are now only two properties for resourceserver (spring.security.oauth2.resourceserver) but still for jwt ‘space’ – wouldn’t it be great to have also spring.security.oauth2.resourceserver.jwt.user-name-attribute with adding some simple handler so it is being handled automatically same as on the client side with some level of consistency on both sides?
Anyway, just thinking loudly – thanks for your answer!