OAuth2Authentication.getPrincipal() returns client_id instead of username - spring

Question

I am using spring-security-oauth2-autoconfigure version 2.1.6.RELEASE to secure a resource server and am trying to get the username that is listed in my jwt. The payload of my jwt contains the client_id and username. When I try to get the Principal from the OAuth2Authentication object, it returns the client_id instead of the username.
For example, if the jwt payload contains:
client_id":"2v3r098kgipu053lph0cb9nfjb","username":"7e953975-0df2-49ff-9b23-cae0864384b7"
And my code is:
#GetMapping("/whoami")
public String whoami(#CurrentSecurityContext OAuth2Authentication auth) {
logger.debug("auth.name: {}", auth.getName() );
logger.debug("auth.principal: {}", auth.getPrincipal());
OAuth2Request req = auth.getOAuth2Request();
logger.debug("req.clientid: {}", req.getClientId() );
return "success";
}
I see the following in the log:
auth.name: 2v3r098kgipu053lph0cb9nfjb
auth.principal: 2v3r098kgipu053lph0cb9nfjb
req.clientid: 2v3r098kgipu053lph0cb9nfjb
What do I need to do to get the username from the jwt?

Answer 1

I was able to figure out the issue.
This is the OAuth2Authentication.getPrincipal() method:
public Object getPrincipal() {
return this.userAuthentication == null ? this.storedRequest.getClientId() : this.userAuthentication
.getPrincipal();
}
auth.getUserAuthentication() returns null so this explains the results I'm seeing.
The reason why this.userAuthentication is null is because the DefaultUserAuthenticationConverter.extractAuthentication(Map<String, ?> map) method tries to set the principal to map.get(USERNAME) where the map is the jwt and USERNAME = "user_name" instead of "username".
This question had a similar issue: Override UserAuthenticationConverter for JWT OAuth Tokens. I was able to use their solution and alter it for my needs. I also decided to use the sub from the jwt instead of username.