We use GeoServer 3.0.1 with the monitoring extension and an OIDC authentication filter in resource server mode (enableResourceServerMode=true). An upstream web application calls WMS server-side and passes a Microsoft Entra v2 access token as Authorization: Bearer ….
Authentication and authorization work as expected: layers are served, and the roles from the roles claim are honoured.
The problem is in the monitoring records. The user column contains the object identity string of the token rather than a user name:
org.springframework.security.oauth2.jwt.Jwt@f9b1d2d5
We need the user name there, because the point of this setup is that GeoServer can attribute each request to a real person.
Setting oidcUserNameAttribute to preferred_username made no difference, which makes sense: that setting governs the interactive login flow, not the resource-server path.
Looking at MonitorFilter in 3.0.1:
java
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = SecurityUtils.getUsername(auth.getPrincipal());
if (username != null) {
data.setRemoteUser(username);
}
For a bearer-token request the authentication is a Spring Security JwtAuthenticationToken, whose principal is a Jwt and not a UserDetails, so the helper appears to fall back to toString(). auth.getName() would return the configured name claim.
Can anyone confirm this is a genuine gap in the bearer-token path rather than something we have misconfigured? If it is, we are happy to file a ticket in JIRA.