InMemoryUserDetailsManager preserve user type

Closes gh-3192

Author: MrJovanovic13

core/src/main/java/org/springframework/security/provisioning/InMemoryUserDetailsManager.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.CredentialsContainer;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.security.core.userdetails.User;
@@ -96,7 +97,13 @@ private User createUserDetails(String name, UserAttribute attr) {
 	@Override
 	public void createUser(UserDetails user) {
 		Assert.isTrue(!userExists(user.getUsername()), "user should not exist");
-		this.users.put(user.getUsername().toLowerCase(), new MutableUser(user));
+
+		if (user instanceof MutableUserDetails mutable) {
+			this.users.put(user.getUsername().toLowerCase(), mutable);
+		}
+		else {
+			this.users.put(user.getUsername().toLowerCase(), new MutableUser(user));
+		}
 	}
 
 	@Override
@@ -154,6 +161,9 @@ public UserDetails loadUserByUsername(String username) throws UsernameNotFoundEx
 		if (user == null) {
 			throw new UsernameNotFoundException(username);
 		}
+		if (user instanceof CredentialsContainer) {
+			return user;
+		}
 		return new User(user.getUsername(), user.getPassword(), user.isEnabled(), user.isAccountNonExpired(),
 				user.isCredentialsNonExpired(), user.isAccountNonLocked(), user.getAuthorities());
 	}

core/src/test/java/org/springframework/security/provisioning/InMemoryUserDetailsManagerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,19 +16,24 @@
 
 package org.springframework.security.provisioning;
 
+import java.util.Collection;
 import java.util.Properties;
 
 import org.junit.jupiter.api.Test;
 
 import org.springframework.security.authentication.TestAuthentication;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.CredentialsContainer;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.security.core.context.SecurityContextImpl;
 import org.springframework.security.core.userdetails.PasswordEncodedUser;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
@@ -97,4 +102,88 @@ public void changePasswordWhenCustomSecurityContextHolderStrategyThenUses() {
 		verify(strategy).getContext();
 	}
 
+	@Test
+	public void createUserWhenUserAlreadyExistsThenException() {
+		assertThatIllegalArgumentException().isThrownBy(() -> this.manager.createUser(this.user))
+			.withMessage("user should not exist");
+	}
+
+	@Test
+	public void createUserWhenNotInstanceOfMutableUserDetailsThenShouldWrapIntoMutableUser() {
+		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
+		final UserDetails user = User.withUserDetails(PasswordEncodedUser.user()).build();
+		manager.createUser(user);
+		UserDetails userDetails = manager.loadUserByUsername(user.getUsername());
+		assertThat(userDetails).isInstanceOf(User.class);
+	}
+
+	@Test
+	public void createUserWhenInstanceOfMutableUserDetailsThenShouldNotWrapIntoMutableUser() {
+		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
+		CustomUser user = new CustomUser(User.withUserDetails(PasswordEncodedUser.user()).build());
+		manager.createUser(user);
+		UserDetails userDetails = manager.loadUserByUsername(user.getUsername());
+		assertThat(userDetails).isInstanceOf(CustomUser.class);
+	}
+
+	@Test
+	public void loadUserByUsernameWhenUserNullThenException() {
+		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
+		assertThatExceptionOfType(UsernameNotFoundException.class)
+			.isThrownBy(() -> manager.loadUserByUsername(this.user.getUsername()));
+	}
+
+	@Test
+	public void loadUserByUsernameWhenUserDetailsNotInstanceOfCredentialsContainerThenReturnUser() {
+		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager(this.user);
+		UserDetails userDetails = manager.loadUserByUsername(this.user.getUsername());
+		assertThat(userDetails).isInstanceOf(User.class);
+	}
+
+	@Test
+	public void loadUserByUsernameWhenUserDetailsInstanceOfCredentialsContainerThenReturnUserDetails() {
+		CustomUser user = new CustomUser(User.withUserDetails(PasswordEncodedUser.user()).build());
+		InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager(user);
+		UserDetails userDetails = manager.loadUserByUsername(user.getUsername());
+		assertThat(userDetails).isInstanceOf(CustomUser.class);
+	}
+
+	static class CustomUser implements MutableUserDetails, CredentialsContainer {
+
+		private final UserDetails delegate;
+
+		private String password;
+
+		CustomUser(UserDetails user) {
+			this.delegate = user;
+			this.password = user.getPassword();
+		}
+
+		@Override
+		public Collection<? extends GrantedAuthority> getAuthorities() {
+			return this.delegate.getAuthorities();
+		}
+
+		@Override
+		public String getPassword() {
+			return this.delegate.getPassword();
+		}
+
+		@Override
+		public void setPassword(final String password) {
+			this.password = password;
+		}
+
+		@Override
+		public String getUsername() {
+			return this.delegate.getUsername();
+		}
+
+		@Override
+		public void eraseCredentials() {
+			this.password = null;
+		}
+
+	}
+
 }