SpringBoot2整合SpringSecurity5抛出NoClassDefFoundError问题排查

我按照Spring Security 5 OAuth2登录的教程配置Google OAuth2客户端认证，但是在解析认证响应的时候出现了java.lang.NoClassDefFoundError: net/minidev/json/JSONAware错误。我已经确认这个类存在于类路径中，但完全搞不懂报错的原因。

我使用的是Spring Boot 2.0.2.RELEASE（对应Spring Security 5.0.5.RELEASE），这是我和示例教程唯一的区别。后来我也尝试过Spring Boot 2.0.1.RELEASE（对应Spring Security 5.0.4.RELEASE），但报错情况完全一样。

完整报错堆栈信息 #

java.lang.ClassNotFoundException: net.minidev.json.JSONAware 
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(Unknown Source) 
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(Unknown Source) 
at java.base/java.lang.ClassLoader.loadClass(Unknown Source) 
at java.base/java.lang.ClassLoader.defineClass1(Native Method) 
at java.base/java.lang.ClassLoader.defineClass(Unknown Source) 
at java.base/java.security.SecureClassLoader.defineClass(Unknown Source) 
at java.base/jdk.internal.loader.BuiltinClassLoader.

我的POM依赖配置 #

<dependencies> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-aop</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-data-mongodb</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-data-redis</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-hateoas</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-mail</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-quartz</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-security</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-validation</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-web</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-websocket</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.security</groupId> 
        <artifactId>spring-security-oauth2-client</artifactId> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.security</groupId> 
        <artifactId>spring-security-oauth2-jose</artifactId> 
    </dependency> 
    <!-- per baeldung example --> 
    <dependency> 
        <groupId>org.projectlombok</groupId> 
        <artifactId>lombok</artifactId> 
        <optional>true</optional> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-tomcat</artifactId> 
        <scope>provided</scope> 
    </dependency> 
    <!-- test --> 
    <dependency> 
        <groupId>org.springframework.boot</groupId> 
        <artifactId>spring-boot-starter-test</artifactId> 
        <scope>test</scope> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.batch</groupId> 
        <artifactId>spring-batch-test</artifactId> 
        <scope>test</scope> 
    </dependency> 
    <dependency> 
        <groupId>org.springframework.security</groupId> 
        <artifactId>spring-security-test</artifactId> 
        <scope>test</scope> 
    </dependency> 
    <dependency> 
        <groupId>de.flapdoodle.embed</groupId> 
        <artifactId>de.flapdoodle.embed.mongo</artifactId> 
        <scope>test</scope> 
    </dependency> 
</dependencies>

已做的排查尝试 #

• 我检查了依赖树，发现json-smart库的2.3版本覆盖了nimbus-jose-jwt使用的1.3.1版本，不知道这是不是导致异常的冲突原因？
• 我尝试移除spring-security-oauth2-jose依赖，但它看起来是生成认证请求所必需的，移除后功能无法正常运行。

现在我想知道：这个版本冲突是不是问题根源？如果是的话，该怎么解决呢？

内容的提问来源于stack exchange，提问作者Roberto Lo Giacco