Use RequiredFactorErrors

rwinch · rwinch · commit 2473378fcd48 · 2025-10-03T15:20:03.000-05:00
Closes gh-18002
diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurerTests.java
@@ -403,7 +403,7 @@ void requestWhenUnauthenticatedThenRequiresTwoSteps() throws Exception {
 		UserDetails user = PasswordEncodedUser.user();
 		this.mockMvc.perform(get("/profile").with(user(user)))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		this.mockMvc
 			.perform(post("/ott/generate").param("username", "rod")
 				.with(user(user))
@@ -421,13 +421,13 @@ void requestWhenUnauthenticatedThenRequiresTwoSteps() throws Exception {
 			.build();
 		this.mockMvc.perform(get("/profile").with(user(user)))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		user = PasswordEncodedUser.withUserDetails(user)
 			.authorities("profile:read", GrantedAuthorities.FACTOR_PASSWORD_AUTHORITY)
 			.build();
 		this.mockMvc.perform(get("/profile").with(user(user)))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=ott"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));
 		user = PasswordEncodedUser.withUserDetails(user)
 			.authorities("profile:read", GrantedAuthorities.FACTOR_PASSWORD_AUTHORITY,
 					GrantedAuthorities.FACTOR_OTT_AUTHORITY)
@@ -444,7 +444,7 @@ void requestWhenUnauthenticatedX509ThenRequiresTwoSteps() throws Exception {
 		this.mockMvc.perform(get("/login")).andExpect(status().isOk());
 		this.mockMvc.perform(get("/profile").with(SecurityMockMvcRequestPostProcessors.x509("rod.cer")))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		this.mockMvc
 			.perform(post("/login").param("username", "rod")
 				.param("password", "password")
diff --git a/docs/src/test/java/org/springframework/security/docs/servlet/authentication/authorizationmanagerfactory/AuthorizationManagerFactoryTests.java b/docs/src/test/java/org/springframework/security/docs/servlet/authentication/authorizationmanagerfactory/AuthorizationManagerFactoryTests.java
@@ -69,7 +69,7 @@ void getWhenAuthenticatedWithPasswordThenRedirectsToOtt() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=ott"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));
 		// @formatter:on
 	}
 
@@ -80,7 +80,7 @@ void getWhenAuthenticatedWithOttThenRedirectsToPassword() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		// @formatter:on
 	}
 
@@ -91,7 +91,7 @@ void getWhenAuthenticatedThenRedirectsToPassword() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		// @formatter:on
 	}
 
diff --git a/docs/src/test/java/org/springframework/security/docs/servlet/authentication/customauthorizationmanagerfactory/CustomAuthorizationManagerFactoryTests.java b/docs/src/test/java/org/springframework/security/docs/servlet/authentication/customauthorizationmanagerfactory/CustomAuthorizationManagerFactoryTests.java
@@ -58,7 +58,7 @@ void getWhenAdminThenRedirectsToOtt() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=ott"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));
 		// @formatter:on
 	}
 
diff --git a/docs/src/test/java/org/springframework/security/docs/servlet/authentication/enableglobalmfa/EnableGlobalMultiFactorAuthenticationTests.java b/docs/src/test/java/org/springframework/security/docs/servlet/authentication/enableglobalmfa/EnableGlobalMultiFactorAuthenticationTests.java
@@ -69,7 +69,7 @@ void getWhenAuthenticatedWithPasswordThenRedirectsToOtt() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=ott"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));
 		// @formatter:on
 	}
 
@@ -80,7 +80,7 @@ void getWhenAuthenticatedWithOttThenRedirectsToPassword() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		// @formatter:on
 	}
 
@@ -91,7 +91,7 @@ void getWhenAuthenticatedThenRedirectsToPassword() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		// @formatter:on
 	}
 
diff --git a/docs/src/test/java/org/springframework/security/docs/servlet/authentication/multifactorauthentication/MultiFactorAuthenticationTests.java b/docs/src/test/java/org/springframework/security/docs/servlet/authentication/multifactorauthentication/MultiFactorAuthenticationTests.java
@@ -69,7 +69,7 @@ void getWhenAuthenticatedWithPasswordThenRedirectsToOtt() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=ott"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));
 		// @formatter:on
 	}
 
@@ -80,7 +80,7 @@ void getWhenAuthenticatedWithOttThenRedirectsToPassword() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		// @formatter:on
 	}
 
@@ -91,7 +91,7 @@ void getWhenAuthenticatedThenRedirectsToPassword() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=password"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
 		// @formatter:on
 	}
 
diff --git a/docs/src/test/java/org/springframework/security/docs/servlet/authentication/reauthentication/ReauthenticationTests.java b/docs/src/test/java/org/springframework/security/docs/servlet/authentication/reauthentication/ReauthenticationTests.java
@@ -69,7 +69,7 @@ void formLoginWhenRequireOttConfigurationThenRedirectsToOtt() throws Exception {
 		// @formatter:off
 		this.mockMvc.perform(get("/profile"))
 			.andExpect(status().is3xxRedirection())
-			.andExpect(redirectedUrl("http://localhost/login?factor=ott"));
+			.andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));
 		// @formatter:on
 	}
 
diff --git a/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/authorizationmanagerfactory/AuthorizationManagerFactoryTests.kt b/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/authorizationmanagerfactory/AuthorizationManagerFactoryTests.kt
@@ -68,7 +68,7 @@ class AuthorizationManagerFactoryTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=ott"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"))
     		// @formatter:on
     }
 
@@ -81,7 +81,7 @@ class AuthorizationManagerFactoryTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=password"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"))
     		// @formatter:on
     }
 
@@ -94,7 +94,7 @@ class AuthorizationManagerFactoryTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=password"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"))
     		// @formatter:on
     }
 
diff --git a/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/customauthorizationmanagerfactory/CustomAuthorizationManagerFactoryTests.kt b/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/customauthorizationmanagerfactory/CustomAuthorizationManagerFactoryTests.kt
@@ -55,7 +55,7 @@ class CustomAuthorizationManagerFactoryTests {
         // @formatter:off
         this.mockMvc!!.perform(get("/"))
             .andExpect(status().is3xxRedirection())
-            .andExpect(redirectedUrl("http://localhost/login?factor=ott"))
+            .andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"))
         // @formatter:on
     }
 
diff --git a/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/enableglobalmfa/AuthorizationManagerFactoryTests.kt b/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/enableglobalmfa/AuthorizationManagerFactoryTests.kt
@@ -68,7 +68,7 @@ class AuthorizationManagerFactoryTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=ott"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"))
     		// @formatter:on
     }
 
@@ -81,7 +81,7 @@ class AuthorizationManagerFactoryTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=password"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"))
     		// @formatter:on
     }
 
@@ -94,7 +94,7 @@ class AuthorizationManagerFactoryTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=password"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"))
     		// @formatter:on
     }
 
diff --git a/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/multifactorauthentication/MultiFactorAuthenticationTests.kt b/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/multifactorauthentication/MultiFactorAuthenticationTests.kt
@@ -66,7 +66,7 @@ class MultiFactorAuthenticationTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=ott"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"))
     		// @formatter:on
     }
 
@@ -78,7 +78,7 @@ class MultiFactorAuthenticationTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=password"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"))
     		// @formatter:on
     }
 
@@ -90,7 +90,7 @@ class MultiFactorAuthenticationTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=password"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"))
     		// @formatter:on
     }
 
diff --git a/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/reauthentication/ReauthenticationTests.kt b/docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/reauthentication/ReauthenticationTests.kt
@@ -68,7 +68,7 @@ class ReauthenticationTests {
         // @formatter:off
         this.mockMvc!!.perform(MockMvcRequestBuilders.get("/profile"))
         .andExpect(MockMvcResultMatchers.status().is3xxRedirection())
-        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor=ott"))
+        .andExpect(MockMvcResultMatchers.redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"))
     		// @formatter:on
     }
 
diff --git a/web/src/main/java/org/springframework/security/web/WebAttributes.java b/web/src/main/java/org/springframework/security/web/WebAttributes.java
@@ -18,7 +18,6 @@
 
 import jakarta.servlet.http.HttpServletRequest;
 
-import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
 
 /**
@@ -56,15 +55,16 @@ public final class WebAttributes {
 			+ ".WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE";
 
 	/**
-	 * Used to set a {@code Collection} of {@link GrantedAuthority} instances into the
-	 * {@link HttpServletRequest}.
+	 * Used to set a {@code Collection} of
+	 * {@link org.springframework.security.authorization.RequiredFactorError} instances
+	 * into the {@link HttpServletRequest}.
 	 * <p>
 	 * Represents what authorities are missing to be authorized for the current request
 	 *
 	 * @since 7.0
 	 * @see org.springframework.security.web.access.DelegatingMissingAuthorityAccessDeniedHandler
 	 */
-	public static final String MISSING_AUTHORITIES = WebAttributes.class + ".MISSING_AUTHORITIES";
+	public static final String REQUIRED_FACTOR_ERRORS = WebAttributes.class + ".REQUIRED_FACTOR_ERRORS	";
 
 	private WebAttributes() {
 	}
diff --git a/web/src/main/java/org/springframework/security/web/access/DelegatingMissingAuthorityAccessDeniedHandler.java b/web/src/main/java/org/springframework/security/web/access/DelegatingMissingAuthorityAccessDeniedHandler.java
@@ -17,11 +17,11 @@
 package org.springframework.security.web.access;
 
 import java.io.IOException;
-import java.util.Collection;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.function.Consumer;
+import java.util.stream.Collectors;
 
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
@@ -32,6 +32,10 @@
 import org.springframework.security.authentication.InsufficientAuthenticationException;
 import org.springframework.security.authorization.AuthorityAuthorizationDecision;
 import org.springframework.security.authorization.AuthorizationDeniedException;
+import org.springframework.security.authorization.AuthorizationResult;
+import org.springframework.security.authorization.FactorAuthorizationDecision;
+import org.springframework.security.authorization.RequiredFactor;
+import org.springframework.security.authorization.RequiredFactorError;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.web.AuthenticationEntryPoint;
@@ -93,15 +97,19 @@ private DelegatingMissingAuthorityAccessDeniedHandler(Map<String, Authentication
 	@Override
 	public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException denied)
 			throws IOException, ServletException {
-		Collection<GrantedAuthority> authorities = missingAuthorities(denied);
-		for (GrantedAuthority needed : authorities) {
-			AuthenticationEntryPoint entryPoint = this.entryPoints.get(needed.getAuthority());
+		List<AuthorityRequiredFactorErrorEntry> authorityErrors = authorityErrors(denied);
+		for (AuthorityRequiredFactorErrorEntry authorityError : authorityErrors) {
+			String requiredAuthority = authorityError.getAuthority();
+			AuthenticationEntryPoint entryPoint = this.entryPoints.get(requiredAuthority);
 			if (entryPoint == null) {
 				continue;
 			}
 			this.requestCache.saveRequest(request, response);
-			request.setAttribute(WebAttributes.MISSING_AUTHORITIES, List.of(needed));
-			String message = String.format("Missing Authorities %s", List.of(needed));
+			RequiredFactorError required = authorityError.getError();
+			if (required != null) {
+				request.setAttribute(WebAttributes.REQUIRED_FACTOR_ERRORS, List.of(required));
+			}
+			String message = String.format("Missing Authorities %s", requiredAuthority);
 			AuthenticationException ex = new InsufficientAuthenticationException(message, denied);
 			entryPoint.commence(request, response, ex);
 			return;
@@ -131,15 +139,39 @@ public void setRequestCache(RequestCache requestCache) {
 		this.requestCache = requestCache;
 	}
 
-	private Collection<GrantedAuthority> missingAuthorities(AccessDeniedException ex) {
+	private List<AuthorityRequiredFactorErrorEntry> authorityErrors(AccessDeniedException ex) {
 		AuthorizationDeniedException denied = findAuthorizationDeniedException(ex);
 		if (denied == null) {
 			return List.of();
 		}
-		if (!(denied.getAuthorizationResult() instanceof AuthorityAuthorizationDecision authorization)) {
-			return List.of();
+		AuthorizationResult authorizationResult = denied.getAuthorizationResult();
+		if (authorizationResult instanceof FactorAuthorizationDecision factorDecision) {
+			// @formatter:off
+			return factorDecision.getFactorErrors().stream()
+				.map((error) -> {
+					String authority = error.getRequiredFactor().getAuthority();
+					return new AuthorityRequiredFactorErrorEntry(authority, error);
+				})
+				.collect(Collectors.toList());
+			// @formatter:on
+		}
+		if (authorizationResult instanceof AuthorityAuthorizationDecision authorityDecision) {
+			// @formatter:off
+			return authorityDecision.getAuthorities().stream()
+				.map((grantedAuthority) -> {
+					String authority = grantedAuthority.getAuthority();
+					if (authority.startsWith("FACTOR_")) {
+						RequiredFactor required = RequiredFactor.withAuthority(authority).build();
+						return new AuthorityRequiredFactorErrorEntry(authority, RequiredFactorError.createMissing(required));
+					}
+					else {
+						return new AuthorityRequiredFactorErrorEntry(authority, null);
+					}
+				})
+				.collect(Collectors.toList());
+			// @formatter:on
 		}
-		return authorization.getAuthorities();
+		return List.of();
 	}
 
 	private @Nullable AuthorizationDeniedException findAuthorizationDeniedException(AccessDeniedException ex) {
@@ -206,4 +238,33 @@ public DelegatingMissingAuthorityAccessDeniedHandler build() {
 
 	}
 
+	/**
+	 * A mapping of a {@link GrantedAuthority#getAuthority()} to a possibly null
+	 * {@link RequiredFactorError}.
+	 *
+	 * @author Rob Winch
+	 * @since 7.0
+	 */
+	private static final class AuthorityRequiredFactorErrorEntry {
+
+		private final String authority;
+
+		private final @Nullable RequiredFactorError error;
+
+		private AuthorityRequiredFactorErrorEntry(String authority, @Nullable RequiredFactorError error) {
+			Assert.notNull(authority, "authority cannot be null");
+			this.authority = authority;
+			this.error = error;
+		}
+
+		private String getAuthority() {
+			return this.authority;
+		}
+
+		private @Nullable RequiredFactorError getError() {
+			return this.error;
+		}
+
+	}
+
 }
diff --git a/web/src/main/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPoint.java b/web/src/main/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPoint.java
diff --git a/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
diff --git a/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java b/web/src/test/java/org/springframework/security/web/authentication/DefaultLoginPageGeneratingFilterTests.java

Original file line number	Diff line number	Diff line change
`@@ -58,7 +58,7 @@ void getWhenAdminThenRedirectsToOtt() throws Exception {`
`58`	`58`	`// @formatter:off`
`59`	`59`	`this.mockMvc.perform(get("/"))`
`60`	`60`	`.andExpect(status().is3xxRedirection())`
`61`		`- .andExpect(redirectedUrl("http://localhost/login?factor=ott"));`
	`61`	`+ .andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));`
`62`	`62`	`// @formatter:on`
`63`	`63`	`}`
`64`	`64`
Original file line number	Diff line number	Diff line change
`@@ -69,7 +69,7 @@ void formLoginWhenRequireOttConfigurationThenRedirectsToOtt() throws Exception {`
`69`	`69`	`// @formatter:off`
`70`	`70`	`this.mockMvc.perform(get("/profile"))`
`71`	`71`	`.andExpect(status().is3xxRedirection())`
`72`		`- .andExpect(redirectedUrl("http://localhost/login?factor=ott"));`
	`72`	`+ .andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));`
`73`	`73`	`// @formatter:on`
`74`	`74`	`}`
`75`	`75`
Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ class CustomAuthorizationManagerFactoryTests {`
`55`	`55`	`// @formatter:off`
`56`	`56`	`this.mockMvc!!.perform(get("/"))`
`57`	`57`	`.andExpect(status().is3xxRedirection())`
`58`		`- .andExpect(redirectedUrl("http://localhost/login?factor=ott"))`
	`58`	`+ .andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"))`
`59`	`59`	`// @formatter:on`
`60`	`60`	`}`
`61`	`61`