fix: add allowIfSubType for URL and Instant in OAuth2ClientJacksonModule

Signed-off-by: hyeonjune <annhj980@naver.com>

Author: qwerty7878

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/jackson/OAuth2ClientJacksonModule.java

@@ -16,6 +16,9 @@
 
 package org.springframework.security.oauth2.client.jackson;
 
+import java.net.URL;
+import java.time.Instant;
+
 import tools.jackson.core.Version;
 import tools.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
 
@@ -94,7 +97,9 @@ public void configurePolymorphicTypeValidator(BasicPolymorphicTypeValidator.Buil
 			.allowIfSubType(OAuth2RefreshToken.class)
 			.allowIfSubType(OAuth2AuthenticationToken.class)
 			.allowIfSubType(OidcUserAuthority.class)
-			.allowIfSubType(OAuth2UserAuthority.class);
+			.allowIfSubType(OAuth2UserAuthority.class)
+			.allowIfSubType(URL.class)
+			.allowIfSubType(Instant.class);
 	}
 
 	@Override

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/jackson/OAuth2AuthenticationTokenMixinTests.java

@@ -16,11 +16,14 @@
 
 package org.springframework.security.oauth2.client.jackson;
 
+import java.net.URL;
 import java.time.Instant;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.stream.Collectors;
 
 import com.fasterxml.jackson.datatype.jsr310.DecimalUtils;
@@ -171,6 +174,33 @@ public void deserializeWhenRequiredAttributesOnlyThenDeserializes() throws Excep
 		assertThat(principal.getUserInfo()).isNull();
 	}
 
+	@Test
+	public void deserializeWhenClaimsContainUrlAndInstantThenDeserializes() throws Exception {
+		Map<String, Object> claims = new HashMap<>();
+		Instant issuedAt = Instant.now();
+		Instant expiresAt = issuedAt.plusSeconds(3600);
+		claims.put(IdTokenClaimNames.ISS, new URL("http://localhost/issuer"));
+		claims.put(IdTokenClaimNames.SUB, "subject");
+		claims.put(IdTokenClaimNames.IAT, issuedAt);
+		claims.put(IdTokenClaimNames.EXP, expiresAt);
+
+		OidcIdToken idToken = new OidcIdToken("id-token", issuedAt, expiresAt, claims);
+		Collection<GrantedAuthority> authorities =
+				Collections.singleton(new OidcUserAuthority(idToken));
+		DefaultOidcUser principal = new DefaultOidcUser(authorities, idToken);
+		OAuth2AuthenticationToken authentication =
+				new OAuth2AuthenticationToken(principal, authorities, "registration-id");
+
+		String json = this.mapper.writeValueAsString(authentication);
+		OAuth2AuthenticationToken deserialized =
+				this.mapper.readValue(json, OAuth2AuthenticationToken.class);
+
+		assertThat(deserialized).isNotNull();
+		DefaultOidcUser deserializedUser = (DefaultOidcUser) deserialized.getPrincipal();
+		assertThat(deserializedUser.getIdToken().getClaims())
+				.containsKey(IdTokenClaimNames.ISS);
+	}
+
 	private static String asJson(OAuth2AuthenticationToken authentication) {
 		String principalJson = (authentication.getPrincipal() instanceof DefaultOidcUser)
 				? asJson((DefaultOidcUser) authentication.getPrincipal())