From a483db676d563050c27a33fd78cde2d5b7c884d0 Mon Sep 17 00:00:00 2001
From: Steve Riesenberg <5248162+sjohnr@users.noreply.github.com>
Date: Fri, 15 Mar 2024 15:14:09 -0500
Subject: [PATCH] Temporarily remove validation logic for jwt token-type

Issue gh-60
---
 .../OAuth2TokenExchangeAuthenticationProvider.java        | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenExchangeAuthenticationProvider.java b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenExchangeAuthenticationProvider.java
index dc710338..4dd8133f 100644
--- a/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenExchangeAuthenticationProvider.java
+++ b/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2TokenExchangeAuthenticationProvider.java
@@ -138,7 +138,9 @@ public final class OAuth2TokenExchangeAuthenticationProvider implements Authenti
 
 		if (JWT_TOKEN_TYPE_VALUE.equals(tokenExchangeAuthentication.getSubjectTokenType()) &&
 				!Jwt.class.isAssignableFrom(subjectToken.getToken().getClass())) {
-			throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
+			// TODO: Need a way to validate subject_token_type, since access tokens
+			//  are always stored as OAuth2AccessToken instead of Jwt.
+			//throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
 		}
 
 		if (subjectAuthorization.getAttribute(Principal.class.getName()) == null) {
@@ -181,7 +183,9 @@ public final class OAuth2TokenExchangeAuthenticationProvider implements Authenti
 
 			if (JWT_TOKEN_TYPE_VALUE.equals(tokenExchangeAuthentication.getActorTokenType()) &&
 					!Jwt.class.isAssignableFrom(actorToken.getToken().getClass())) {
-				throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
+				// TODO: Need a way to validate actor_token_type, since access tokens
+				//  are always stored as OAuth2AccessToken instead of Jwt.
+				//throw new OAuth2AuthenticationException(OAuth2ErrorCodes.INVALID_REQUEST);
 			}
 
 			if (StringUtils.hasText(authorizedActorSubject) &&