fix: resolve Postman test failures (OIDC URL, redirect URI, auth code skip)#8
Merged
stupidly-logical merged 1 commit intomainfrom Apr 4, 2026
Merged
Conversation
- Fix OIDC discovery URL typo in Postman collection (openid_configuration → openid-configuration); the hyphenated path is what Spring AS serves - Add https://oauth.pstmn.io/v1/callback to registered client redirect URIs so Postman's built-in OAuth2 callback is accepted - Disable requireProofKey on test-client so the auth code flow can be tested from Postman without PKCE (development client only) - Add pm.execution.skipRequest() guards to Exchange Code and Refresh Token requests so they skip gracefully instead of failing when no authorization_code / refresh_token is available in the environment (these flows require a manual browser login step) Introspection returning active=false for the client-credentials token is not yet resolved — requires live server debugging to identify whether the root cause is JDBC BLOB comparison, token persistence, or a stale env variable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openid_configuration(underscore); Spring AS servesopenid-configuration(hyphen per RFC 8414)https://oauth.pstmn.io/v1/callbacktotest-clientso Postman's OAuth2 callback is accepted during manual auth code flow testingtest-client(requireProofKey: false) so the auth code flow can be tested from Postman without a code challengepm.execution.skipRequest()pre-request guards so these requests skip instead of fail when noauthorization_codeorrefresh_tokenis present (they require a manual browser login step)What's still open
Token introspection returning
active: falseimmediately after a successful client credentials token issue is not yet fixed — it requires live server debugging (suggested: addTRACElogging onorg.springframework.security.oauth2.server.authorizationand inspect thesave()/findByToken()call pair).Test plan
authorization_codeenv var, re-run collection — full auth code + refresh flow should succeed🤖 Generated with Claude Code