{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/560","labels_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/560/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/560/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/560/events","html_url":"https://github.com/spring-projects/spring-security-oauth/issues/560","id":102963780,"number":560,"title":"RemoteTokenServices can't parse nested collections within the token's authentication details","user":{"login":"vicmosin","id":612207,"avatar_url":"https://avatars.githubusercontent.com/u/612207?v=3","gravatar_id":"","url":"https://api.github.com/users/vicmosin","html_url":"https://github.com/vicmosin","followers_url":"https://api.github.com/users/vicmosin/followers","following_url":"https://api.github.com/users/vicmosin/following{/other_user}","gists_url":"https://api.github.com/users/vicmosin/gists{/gist_id}","starred_url":"https://api.github.com/users/vicmosin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vicmosin/subscriptions","organizations_url":"https://api.github.com/users/vicmosin/orgs","repos_url":"https://api.github.com/users/vicmosin/repos","events_url":"https://api.github.com/users/vicmosin/events{/privacy}","received_events_url":"https://api.github.com/users/vicmosin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-25T07:00:24Z","updated_at":"2015-09-02T08:36:58Z","closed_at":null,"body":"There is an OAuth2 server based on `spring-security-oauth2 2.0.7.RELEASE`. All the configurations are default except of using `JwtAccessTokenConverter` as a token converter.\r\n\r\nResource server uses the same oauth library. In order to validate the token, it calls oauth server's `/check_token` endpoint which returns either `JSON` or `XML` representation of token. This call is made within the `RemoteTokenServices.loadAuthentication` method which uses a `RestTemplate` as a transport layer. The problem is that somewhere inside the template's implementation there is a code, which add a `Accept: application/xml;...` header. This behavior causes oauth server response with XML and `RestTemplate` can't parse correctly the nested collections (i.e. `authorities` and `scope` fields) within the response - they are always treated as `String` and not as `Collection`. \r\n\r\nThe solution is either override the `RemoteTokenServices` and add manually the `Accept: application/json;` header or change oauth server's behavior to ignore this header and return `JSON` by default."},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/comments/136976753","html_url":"https://github.com/spring-projects/spring-security-oauth/issues/560#issuecomment-136976753","issue_url":"https://api.github.com/repos/spring-projects/spring-security-oauth/issues/560","id":136976753,"user":{"login":"dsyer","id":124075,"avatar_url":"https://avatars.githubusercontent.com/u/124075?v=3","gravatar_id":"","url":"https://api.github.com/users/dsyer","html_url":"https://github.com/dsyer","followers_url":"https://api.github.com/users/dsyer/followers","following_url":"https://api.github.com/users/dsyer/following{/other_user}","gists_url":"https://api.github.com/users/dsyer/gists{/gist_id}","starred_url":"https://api.github.com/users/dsyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsyer/subscriptions","organizations_url":"https://api.github.com/users/dsyer/orgs","repos_url":"https://api.github.com/users/dsyer/repos","events_url":"https://api.github.com/users/dsyer/events{/privacy}","received_events_url":"https://api.github.com/users/dsyer/received_events","type":"User","site_admin":false},"created_at":"2015-09-02T08:36:58Z","updated_at":"2015-09-02T08:36:58Z","body":"`RemoteTokenServices` uses a stock `RestTemplate` that it creates itself unless you inject one yourself. I suspect you have changed the default settings somehow if it is sending `Accept: ...` in any form."}}