Merge "Make preferred_username optional for Keycloak"
diff --git a/BUILD b/BUILD
index 0d2e0e4..81871ad 100644
--- a/BUILD
+++ b/BUILD
@@ -21,6 +21,7 @@
     resources = glob(["src/main/resources/**/*"]),
     deps = [
         "@commons-codec//jar:neverlink",
+        "@jackson-core//jar",
         "@jackson-databind//jar",
         "@scribejava-apis//jar",
         "@scribejava-core//jar",
diff --git a/external_plugin_deps.bzl b/external_plugin_deps.bzl
index ffe8a31..aaab198 100644
--- a/external_plugin_deps.bzl
+++ b/external_plugin_deps.bzl
@@ -26,6 +26,11 @@
             "@jackson-annotations//jar",
         ],
     )
+    maven_jar(
+        name = "jackson-core",
+        artifact = "com.fasterxml.jackson.core:jackson-core:" + JACKSON_VERS,
+        sha1 = "73d4322a6bda684f676a2b5fe918361c4e5c7cca",
+    )
     if not omit_commons_codec:
         maven_jar(
             name = "commons-codec",
diff --git a/src/main/java/com/googlesource/gerrit/plugins/oauth/AzureActiveDirectoryService.java b/src/main/java/com/googlesource/gerrit/plugins/oauth/AzureActiveDirectoryService.java
index 81dc53f..49077fb 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/oauth/AzureActiveDirectoryService.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/oauth/AzureActiveDirectoryService.java
@@ -236,7 +236,7 @@
     // Extract the payload part from the JWT token (header.payload.signature) by retrieving
     // tokenParts[1].
     return gson.fromJson(
-        new String(Base64.getDecoder().decode(tokenParts[1]), StandardCharsets.UTF_8),
+        new String(Base64.getUrlDecoder().decode(tokenParts[1]), StandardCharsets.UTF_8),
         JsonObject.class);
   }
 }