spring-projects/spring-security

Hi, I have the following code, it's a MDCFilter.

import org.slf4j.MDC;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthentication;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebFilter;
import org.springframework.web.server.WebFilterChain;
import reactor.core.publisher.Mono;

public class NettyMDCFilter implements WebFilter {

    public static final String USER_AND_APPLICATION_KEY = "user";
    public static final String APPLICATION_KEY = "application";
    public static final String USERNAME_KEY = "username";

    @Override
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
        return exchange.<OAuth2Authentication>getPrincipal()
            .doOnNext(this::logWithContext)
            .map(auth -> exchange)
            .switchIfEmpty(Mono.just(exchange))
            .flatMap(chain::filter)
            .doFinally(signalType -> removeMDCKeys());
    }

    private void logWithContext(OAuth2Authentication authentication) {
        MDC.put(USER_AND_APPLICATION_KEY, userKey(authentication));
        if (authentication.isClientOnly()) {
            MDC.put(APPLICATION_KEY, authentication.getName());
        } else {
            MDC.put(APPLICATION_KEY, authentication.getOAuth2Request().getClientId());
            MDC.put(USERNAME_KEY, authentication.getName());
        }
    }

    private void removeMDCKeys() {
        MDC.remove(USER_AND_APPLICATION_KEY);
        MDC.remove(USERNAME_KEY);
        MDC.remove(APPLICATION_KEY);
    }

    private String userKey(OAuth2Authentication authentication) {
        if (authentication.isClientOnly()) {
            return authentication.getName();
        } else {
            return String.format("%s:%s", authentication.getOAuth2Request().getClientId(), authentication.getName());
        }
    }
}

In the previous implementation was implemented using the class OAuth2Authentication, that belongs to the project the project spring-security-oauth, but this project now is under maintance mode , as you can see here . In my code, I want to check in the filter if the token belongs to a client application or to an user, but I don't have any idea about how could I do this in the new version of spring-security , even reading the documentation it's not clear for me what I should do, because there isn't a migration tutorial to migrate from spring-security-oauth2 project to the spring security project new version with built-in support to oauth2. I googled, but couldn't find a concrete tutorial to help me with this problem.