Project: mule
Issue MULE-8821: Concurrent calls to the OAuth2 authorize MessageProcessor fail when passing different values for accessTokenUrl
When the authorize MessageProcessor is invoked by 2 different users at the same time and each of those invocations is done with a different value for the accessTokenUrl, the access token request for one of them is made to the wrong url. I am using the salesforce connector v6.2.1 and this is how my authorize call looks like: The flowVar salesforceUrl can take 2 possible values, which are: https://login.salesforce.com (Salesforce Production) https://test.salesforce.com (Salesforce Sandbox) When a user does the OAuth dance to login.salesforce.com at the same time another user does the OAuth dance to test.salesforce.com, one of the dances fail. ------------------------------------------------------------------------------------------ I believe the problem can be found in the way the accessTokenUrl is retrieved and saved by these 2 processors (in mule-devkit-support): - org.mule.security.oauth.processor.BaseOAuth2AuthorizeMessageProcessor - org.mule.security.oauth.processor.OAuth2FetchAccessTokenMessageProcessor The BaseOAuth2AuthorizeMessageProcessor (line 81) saves the accessTokenUrl value in the defaultUnauthorizedConnector object of the OAuth2Manager. The OAuth2FetchAccessTokenMessageProcessor (line 57) obtains an OAuth2Adapter (used to fetch the access token) from the OAuth2Manager. The OAuth2Manager creates the adapter setting the accessTokenUrl (line 256 BaseOAuth2Manager) with the value taken from the defaultUnauthorizedConnector object. https://github.com/mulesoft/mule/blob/mule-3.5.2/modules/devkit-support/src/main/java/org/mule/security/oauth/processor/BaseOAuth2AuthorizeMessageProcessor.java#L81 https://github.com/mulesoft/mule/blob/mule-3.5.2/modules/devkit-support/src/main/java/org/mule/security/oauth/processor/OAuth2FetchAccessTokenMessageProcessor.java#L57 https://github.com/mulesoft/mule/blob/mule-3.5.2/modules/devkit-support/src/main/java/org/mule/security/oauth/BaseOAuth2Manager.java#L256 The defaultUnauthorizedConnector of the OAuth2Manager is common to all events and threads. I believe that when 2 users are doing the oauth dance at the same time the accessTokenUrl value of the defaultUnauthorizedConnector is being overwritten by the second user before the first is able to fetch the access token.
Story points: 8