Bugfix/4.0.2 (#1938)

NiklasHerrmann21 · web-flow · commit ea432c80a625 · 2026-04-02T11:55:16.000+02:00
* fix: Use getClientIdentity() for token exchange credentials

Simplified DefaultIdTokenExtension and DefaultXsuaaTokenExtension to use
OAuth2ServiceConfiguration.getClientIdentity() instead of manually checking
for certificate vs client secret. This ensures correct credential handling
for both X.509 certificate and client secret authentication.

Also added IAS certificate properties (certificate, key, credential-type,
certurl) to IdentityServicesPropertySourceFactory to properly map X.509
credentials for IAS service bindings.

Changes:
- DefaultIdTokenExtension: Use iasConfig.getClientIdentity()
- DefaultXsuaaTokenExtension: Use xsuaaConfig.getClientIdentity()
- IdentityServicesPropertySourceFactory: Add IAS certificate properties

* test: Update tests to use getClientIdentity() mocks

* chore: Release 4.0.2

* test: Remove unused credentials variables from tests
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,11 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## 4.0.2
+
+- Fix token exchange credential handling to use `getClientIdentity()` instead of manually checking for certificate vs client secret
+- Add IAS certificate properties (`certificate`, `key`, `credential-type`, `certurl`) to `IdentityServicesPropertySourceFactory` to properly map X.509 credentials for IAS service bindings
+
 ## 4.0.1
 
 - Fix IAS token exchange to use `getUrl()` instead of `getCertUrl()` in `DefaultIdTokenExtension`
diff --git a/MIGRATION_4.0.md b/MIGRATION_4.0.md
@@ -58,7 +58,7 @@ If you use these classes, add the new dependency:
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 No code changes required - the classes remain in the same package.
@@ -88,7 +88,7 @@ No code changes required - the classes remain in the same package.
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-starter</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
@@ -146,7 +146,7 @@ Replace the standard starter with the Spring Boot 3 starter:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
@@ -203,7 +203,7 @@ The `spring-xsuaa` module has been removed. Migrate to either:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-security-test</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
     <scope>test</scope>
 </dependency>
 ```
@@ -234,7 +234,7 @@ import com.sap.cloud.security.test.JwtGenerator;
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>spring-security-3</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
@@ -272,7 +272,7 @@ The `token-client` module now uses Java 11 HttpClient by default - no additional
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
@@ -326,7 +326,7 @@ If you use any of these classes, add the new dependency:
 <dependency>
     <groupId>com.sap.cloud.security.xsuaa</groupId>
     <artifactId>token-client-spring</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
diff --git a/README.md b/README.md
@@ -120,7 +120,7 @@ If your application uses Spring Boot 3.x and you cannot immediately upgrade to S
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
@@ -275,7 +275,7 @@ The SAP Cloud Security Services Integration is published to maven central: https
         <dependency>
             <groupId>com.sap.cloud.security</groupId>
             <artifactId>java-bom</artifactId>
-            <version>4.0.1</version>
+            <version>4.0.2</version>
             <scope>import</scope>
             <type>pom</type>
         </dependency>
diff --git a/bom/pom.xml b/bom/pom.xml
@@ -8,7 +8,7 @@
 
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-bom</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
     <packaging>pom</packaging>
     <name>java-bom</name>
 
diff --git a/env/pom.xml b/env/pom.xml
@@ -9,7 +9,7 @@
     <parent>
         <groupId>com.sap.cloud.security.xsuaa</groupId>
         <artifactId>parent</artifactId>
-        <version>4.0.1</version>
+        <version>4.0.2</version>
     </parent>
 
     <groupId>com.sap.cloud.security</groupId>
diff --git a/java-api/README.md b/java-api/README.md
@@ -5,6 +5,6 @@
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-api</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
diff --git a/java-api/pom.xml b/java-api/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.1</version>
+		<version>4.0.2</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security-test/README.md b/java-security-test/README.md
@@ -40,7 +40,7 @@ It is pre-configured with a security filter that only accepts valid tokens. Furt
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
    <artifactId>java-security-test</artifactId>
-      <version>4.0.1</version>
+      <version>4.0.2</version>
    <scope>test</scope>
 </dependency>
 ```
diff --git a/java-security-test/pom.xml b/java-security-test/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.1</version>
+		<version>4.0.2</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/README.md b/java-security/README.md
@@ -69,7 +69,7 @@ Since it requires the Tomcat 10 runtime, it needs to be deployed using the [SAP
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>java-security</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 <dependency>
     <groupId>org.apache.httpcomponents</groupId>
diff --git a/java-security/pom.xml b/java-security/pom.xml
@@ -9,7 +9,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.1</version>
+		<version>4.0.2</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/java-security/src/main/java/com/sap/cloud/security/token/DefaultIdTokenExtension.java b/java-security/src/main/java/com/sap/cloud/security/token/DefaultIdTokenExtension.java
@@ -2,8 +2,6 @@
 
 import static java.util.Objects.nonNull;
 
-import com.sap.cloud.security.config.ClientCertificate;
-import com.sap.cloud.security.config.ClientCredentials;
 import com.sap.cloud.security.config.OAuth2ServiceConfiguration;
 import com.sap.cloud.security.xsuaa.client.OAuth2ServiceException;
 import com.sap.cloud.security.xsuaa.client.OAuth2TokenResponse;
@@ -142,34 +140,21 @@ private boolean isTechnicalUser(Token token) {
   private OAuth2TokenResponse exchangeAccessToIDToken(Token accessToken)
       throws OAuth2ServiceException {
 
-    final String certPem = iasConfig.getProperty("certificate");
-    final String keyPem = iasConfig.getProperty("key");
-    final String clientId = iasConfig.getClientId();
     final URI tokenEndpoint = URI.create(iasConfig.getUrl().toString() + "/oauth2/token");
 
     final Map<String, String> params = new HashMap<>();
     params.put("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
     params.put("assertion", accessToken.getTokenValue());
     params.put("token_format", "jwt");
     params.put("refresh_expiry", "0");
-    params.put("client_id", clientId);
-
-    if (certPem != null && keyPem != null) {
-      return tokenService.retrieveAccessTokenViaJwtBearerTokenGrant(
-          tokenEndpoint,
-          new ClientCertificate(clientId, certPem, keyPem),
-          accessToken.getTokenValue(),
-          null,
-          params,
-          false);
-    } else {
-      return tokenService.retrieveAccessTokenViaJwtBearerTokenGrant(
-          tokenEndpoint,
-          new ClientCredentials(clientId, iasConfig.getClientSecret()),
-          accessToken.getTokenValue(),
-          null,
-          params,
-          false);
-    }
+    params.put("client_id", iasConfig.getClientId());
+
+    return tokenService.retrieveAccessTokenViaJwtBearerTokenGrant(
+        tokenEndpoint,
+        iasConfig.getClientIdentity(),
+        accessToken.getTokenValue(),
+        null,
+        params,
+        false);
   }
 }
diff --git a/java-security/src/test/java/com/sap/cloud/security/token/DefaultIdTokenExtensionTest.java b/java-security/src/test/java/com/sap/cloud/security/token/DefaultIdTokenExtensionTest.java
@@ -11,6 +11,8 @@
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
 
+import com.sap.cloud.security.config.ClientCertificate;
+import com.sap.cloud.security.config.ClientCredentials;
 import com.sap.cloud.security.config.OAuth2ServiceConfiguration;
 import com.sap.cloud.security.xsuaa.client.OAuth2ServiceException;
 import com.sap.cloud.security.xsuaa.client.OAuth2TokenResponse;
@@ -45,12 +47,11 @@ public void setUp() throws IOException {
     SecurityContext.clearContext();
     when(serviceConfiguration.getUrl()).thenReturn(tokenUri);
     when(serviceConfiguration.getClientId()).thenReturn(clientId);
-    String clientSecret = "clientSecret";
-    when(serviceConfiguration.getClientSecret()).thenReturn(clientSecret);
-    String certPem = "certPem";
-    when(serviceConfiguration.getProperty("certificate")).thenReturn(certPem);
-    String keyPem = "keyPem";
-    when(serviceConfiguration.getProperty("key")).thenReturn(keyPem);
+
+    // Mock getClientIdentity() to return appropriate ClientIdentity based on config
+    ClientCertificate clientCert = new ClientCertificate("certPem", "keyPem", clientId);
+    when(serviceConfiguration.getClientIdentity()).thenReturn(clientCert); // default to cert
+
     String audience = "audience";
     when(idToken.getClaimAsStringList("aud")).thenReturn(List.of(audience, clientId));
     when(idToken.getClientId()).thenReturn(clientId);
@@ -137,8 +138,7 @@ public void resolveIdToken_tokenIsAccessTokenWithCertificate_exchangeTokenForTok
       resolveIdToken_tokenIsAccessTokenWithClientCredentials_exchangeTokenForTokenWithClientSecret()
           throws OAuth2ServiceException {
     SecurityContext.setToken(accessToken);
-    when(serviceConfiguration.getProperty("certificate")).thenReturn(null);
-    when(serviceConfiguration.getProperty("key")).thenReturn(null);
+    when(serviceConfiguration.getClientIdentity()).thenReturn(new ClientCredentials(clientId, "clientSecret"));
     ArgumentCaptor<String> tokenCaptor = ArgumentCaptor.forClass(String.class);
     ArgumentCaptor<Map<String, String>> paramCaptor = ArgumentCaptor.forClass(Map.class);
 
diff --git a/pom.xml b/pom.xml
@@ -7,7 +7,7 @@
 
 	<groupId>com.sap.cloud.security.xsuaa</groupId>
 	<artifactId>parent</artifactId>
-	<version>4.0.1</version>
+	<version>4.0.2</version>
 	<packaging>pom</packaging>
 
 	<name>parent</name>
diff --git a/spring-security-3-starter/pom.xml b/spring-security-3-starter/pom.xml
@@ -16,7 +16,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.1</version>
+		<version>4.0.2</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/spring-security-3/README.md b/spring-security-3/README.md
@@ -23,7 +23,7 @@ Use the Spring Boot 3.x starter instead:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-3-starter</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
diff --git a/spring-security-3/pom.xml b/spring-security-3/pom.xml
@@ -9,14 +9,14 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.1</version>
+		<version>4.0.2</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
 	<artifactId>spring-security-3</artifactId>
 	<name>spring-security-3</name>
 	<packaging>jar</packaging>
-	<version>4.0.1</version>
+	<version>4.0.2</version>
 
 	<url>https://github.com/SAP/cloud-security-xsuaa-integration</url>
 	<description>Java Spring security library for Spring Boot 3</description>
diff --git a/spring-security-3/src/main/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactory.java b/spring-security-3/src/main/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactory.java
@@ -55,7 +55,8 @@ public class IdentityServicesPropertySourceFactory implements PropertySourceFact
 					"key", "credential-type", "certurl", "name", "plan", "app_identifier"));
 
 	private static final List<String> IAS_ATTRIBUTES = Collections.unmodifiableList(Arrays
-			.asList("clientid", "clientsecret", "domains", "url", "name", "plan"));
+			.asList("clientid", "clientsecret", "domains", "url", "name", "plan",
+					"certificate", "key", "credential-type", "certurl"));
 
 	private Properties properties;
 
diff --git a/spring-security-3/src/test/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactoryTest.java b/spring-security-3/src/test/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactoryTest.java
@@ -39,6 +39,12 @@ void testInjectedPropertyValues() {
 		assertEquals("iasdomain", configuration.identityDomains.get(0));
 		assertEquals("identityInstance0", configuration.identityName);
 		assertEquals("broker", configuration.identityPlan);
+
+		// Certificate-based authentication properties for IAS
+		assertEquals("-----BEGIN CERTIFICATE-----\ntest-cert\n-----END CERTIFICATE-----", configuration.identityCertificate);
+		assertEquals("-----BEGIN RSA PRIVATE KEY-----\ntest-key\n-----END RSA PRIVATE KEY-----", configuration.identityKey);
+		assertEquals("X509_GENERATED", configuration.identityCredentialType);
+		assertEquals("https://cert.iasdomain", configuration.identityCertUrl);
 	}
 }
 
@@ -85,4 +91,16 @@ class TestConfigurationFromFile {
 
 	@Value("${sap.security.services.identity.plan:}")
 	public String identityPlan;
+
+	@Value("${sap.security.services.identity.certificate:}")
+	public String identityCertificate;
+
+	@Value("${sap.security.services.identity.key:}")
+	public String identityKey;
+
+	@Value("${sap.security.services.identity.credential-type:}")
+	public String identityCredentialType;
+
+	@Value("${sap.security.services.identity.certurl:}")
+	public String identityCertUrl;
 }
diff --git a/spring-security-3/src/test/resources/singleXsuaaAndIasBinding.json b/spring-security-3/src/test/resources/singleXsuaaAndIasBinding.json
@@ -18,7 +18,11 @@
         "clientid": "client-id-ias",
         "clientsecret": "client-secret-ias",
         "url": "http://domain.iasdomain",
-        "domains": ["iasdomain"]
+        "domains": ["iasdomain"],
+        "certificate": "-----BEGIN CERTIFICATE-----\ntest-cert\n-----END CERTIFICATE-----",
+        "key": "-----BEGIN RSA PRIVATE KEY-----\ntest-key\n-----END RSA PRIVATE KEY-----",
+        "credential-type": "X509_GENERATED",
+        "certurl": "https://cert.iasdomain"
       },
       "name": "identityInstance0",
       "plan": "broker"
diff --git a/spring-security-starter/pom.xml b/spring-security-starter/pom.xml
@@ -16,7 +16,7 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.1</version>
+		<version>4.0.2</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
diff --git a/spring-security/README.md b/spring-security/README.md
@@ -69,7 +69,7 @@ These (spring) dependencies need to be provided:
 <dependency>
     <groupId>com.sap.cloud.security</groupId>
     <artifactId>resourceserver-security-spring-boot-starter</artifactId>
-    <version>4.0.1</version>
+    <version>4.0.2</version>
 </dependency>
 ```
 
diff --git a/spring-security/pom.xml b/spring-security/pom.xml
@@ -9,14 +9,14 @@
 	<parent>
 		<groupId>com.sap.cloud.security.xsuaa</groupId>
 		<artifactId>parent</artifactId>
-		<version>4.0.1</version>
+		<version>4.0.2</version>
 	</parent>
 
 	<groupId>com.sap.cloud.security</groupId>
 	<artifactId>spring-security</artifactId>
 	<name>spring-security</name>
 	<packaging>jar</packaging>
-	<version>4.0.1</version>
+	<version>4.0.2</version>
 
 	<url>https://github.com/SAP/cloud-security-xsuaa-integration</url>
 	<description>Java Spring security library</description>
diff --git a/spring-security/src/main/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactory.java b/spring-security/src/main/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactory.java
diff --git a/spring-security/src/test/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactoryTest.java b/spring-security/src/test/java/com/sap/cloud/security/spring/config/IdentityServicesPropertySourceFactoryTest.java
diff --git a/spring-security/src/test/resources/singleXsuaaAndIasBinding.json b/spring-security/src/test/resources/singleXsuaaAndIasBinding.json
diff --git a/token-client-spring-3/README.md b/token-client-spring-3/README.md
diff --git a/token-client-spring-3/pom.xml b/token-client-spring-3/pom.xml
diff --git a/token-client-spring/README.md b/token-client-spring/README.md
diff --git a/token-client-spring/pom.xml b/token-client-spring/pom.xml
diff --git a/token-client/README.md b/token-client/README.md
diff --git a/token-client/pom.xml b/token-client/pom.xml
diff --git a/token-client/src/main/java/com/sap/cloud/security/xsuaa/client/DefaultXsuaaTokenExtension.java b/token-client/src/main/java/com/sap/cloud/security/xsuaa/client/DefaultXsuaaTokenExtension.java
diff --git a/token-client/src/test/java/com/sap/cloud/security/xsuaa/client/DefaultXsuaaTokenExtensionTest.java b/token-client/src/test/java/com/sap/cloud/security/xsuaa/client/DefaultXsuaaTokenExtensionTest.java
