fix: Allow OidcAuthorizedClientRefreshedEventListener refreshing if authentication subclasses OAuth2AuthenticationToken - 2

Author: mpalourdio

config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcUserRefreshedEventListenerConfigurationTests.java

@@ -237,11 +237,14 @@ public void authorizeWhenAuthenticationIsCustomThenOidcUserNotRefreshed() {
 
 		OAuth2AuthorizedClient authorizedClient = createAuthorizedClient();
 		OAuth2AccessTokenResponse accessTokenResponse = createAccessTokenResponse(OidcScopes.OPENID);
+		Jwt jwt = createJwt().build();
 		given(this.authorizedClientRepository.loadAuthorizedClient(anyString(), any(Authentication.class),
 				any(HttpServletRequest.class)))
-			.willReturn(authorizedClient);
+				.willReturn(authorizedClient);
 		given(this.refreshTokenAccessTokenResponseClient.getTokenResponse(any(OAuth2RefreshTokenGrantRequest.class)))
-			.willReturn(accessTokenResponse);
+				.willReturn(accessTokenResponse);
+		given(this.jwtDecoder.decode(anyString())).willReturn(jwt);
+		given(this.oidcUserService.loadUser(any(OidcUserRequest.class))).willReturn(createOidcUser());
 
 		OidcUser oidcUser = createOidcUser();
 		OAuth2AuthenticationToken authentication = new CustomOAuth2AuthenticationToken(oidcUser,
@@ -250,12 +253,15 @@ public void authorizeWhenAuthenticationIsCustomThenOidcUserNotRefreshed() {
 		SecurityContextHolder.setContext(securityContext);
 
 		OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest
-			.withClientRegistrationId(GOOGLE_CLIENT_REGISTRATION.getRegistrationId())
-			.principal(authentication)
-			.build();
+				.withClientRegistrationId(GOOGLE_CLIENT_REGISTRATION.getRegistrationId())
+				.principal(authentication)
+				.build();
 		OAuth2AuthorizedClient refreshedAuthorizedClient = this.authorizedClientManager.authorize(authorizeRequest);
 		assertThat(refreshedAuthorizedClient).isNotNull();
-		verifyNoInteractions(this.securityContextRepository, this.jwtDecoder, this.oidcUserService);
+		assertThat(refreshedAuthorizedClient).isNotSameAs(authorizedClient);
+		assertThat(refreshedAuthorizedClient.getClientRegistration()).isEqualTo(GOOGLE_CLIENT_REGISTRATION);
+		assertThat(refreshedAuthorizedClient.getAccessToken()).isEqualTo(accessTokenResponse.getAccessToken());
+		assertThat(refreshedAuthorizedClient.getRefreshToken()).isEqualTo(accessTokenResponse.getRefreshToken());
 	}
 
 	@Test