Spring security 5.1.x override dependency com.nimbusds:oauth2-oidc-sdk version.

When web application leverage spring boot 2.1.x (5.1.x spring security) with azure active directory boot starter, the spring security 5.1.x may override dependency com.nimbusds:oauth2-oidc-sdk from 5.64.4 to 6.0. This 6.0 new version changed the interface API.

azure active directory boot starter depends on AAD java libray, it leverage version 5.64.4. So below override with API change may result in CastException when auth. Details see this issue.

So there is one workaround for this issue like specific 5.64.4 explicitly for com.nimbusds:oauth2-oidc-sdk when users depends on spring boot 2.1.x. But it is difficult to make sure that is there any other risk with this workaround.

Is there any other better solution for this problem, or is there any way to measure the impact with the workaround ? Thanks in advance. Your professional advice is very important to us.

[Incarnation-p-lee]

Thanks @jgrandja and @jzheaux for you professional advice. We may co-work with AAD java library for this conflict first, or override the version on depends. Thanks again for your help.

[Incarnation-p-lee]

@jzheaux Agree. I mean session work well, just personal interest about the session stateless part. I can search that first. Thanks a lot.