Spring security oauth2 fails issuer validation after 30 seconds

Question

In a reactive spring webflux service, I have the endpoints configured to be protected by OAuth2 resource server. When I first launch the server, it validates the Bearer tokens properly but after about 30 seconds, the exact same requests begin failing with the following error:

error="invalid_token"
error_description="This iss claim is not equal to the configured issuer"
error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

I've verified that the token is valid and that the iss claim appears to be the same as what is configured in spring.security.oauth2.resourceserver.jwt.issuer-uri. If this wasn't configured properly, then I would be getting no valid requests.

Upon closer inspection, I've found that the error stems from the URL comparison of the iss claim and the expected URL in that the InetAddress.getAddress() match for the first 30 seconds, but then do not match. This is using an Azure AD provider endpoint https://sts.windows.net/{{tenantId}}/ and I've verified that the URL strings match, just not the internal addresses. What might be causing this and how can I validate tokens with valid issuers after the initial 30 seconds? Thanks.

For reference, here is my SecurityWebFilterChain:

@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
    return http
            .csrf().disable()
            .authorizeExchange().anyExchange().authenticated()
            .and().oauth2ResourceServer().jwt().and()
            .and().build();
}

Gradle implementations included:

org.springframework.boot:spring-boot-starter-security:2.1.0.RC1
org.springframework.boot:spring-boot-starter-webflux:2.1.0.RC1
org.springframework.security:spring-security-oauth2-resource-server:5.1.1.RELEASE
org.springframework.security:spring-security-oauth2-jose:5.1.1.RELEASE

Answer 1

Looks like this was entered as issue #6073 in spring-security and was resolved in c70b65c. It's currently slated to be resolved in 5.1.2.RELEASE or 5.2.0.M1.

The solution committed changed the URL to a String which allowed for the equality check to be more reliable in addition to removing the blocking DNS lookup call.