SecurityUtils.getUsername() does not support Spring Jwt principals monitor extension

GeoServer GeoServer User
1

With GeoServer 3.0.1 using the official OIDC extension and Microsoft Entra ID authentication, Monitor audit logs contain:

org.springframework.security.oauth2.jwt.Jwt@792fca0a

Checking the repo:

MonitorFilter
→ SecurityUtils.getUsername(auth.getPrincipal()) and SecurityUtils.getUsername() falls back to principal.toString() for principals that are not

UserDetails
Principal

org.springframework.security.oauth2.jwt.Jwt is neither of those types, resulting in the object reference being written to audit logs.

Issue found with help off AI. Possible fixes (also with AI as I can not code nor really understand this, but it might help to fix this)

Possible Fix
Instead of extracting the username directly from the principal object, use the authenticated Spring Security identity:

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();

This is generally more robust and avoids assumptions about the principal implementation class. It should work consistently across:
•UserDetails
•OIDC
•OAuth2
•JWT
•future authentication providers

Thanks for further investigating/solving this

1 Like