Fix inconsistent state when authorization consent is denied

Closes gh-595

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 the original author or authors.
+ * Copyright 2020-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -577,8 +577,6 @@ public final class OAuth2AuthorizationCodeRequestAuthenticationProvider implemen
 				.scopes(authorizationCodeRequestAuthentication.getScopes())
 				.state(authorizationCodeRequestAuthentication.getState())
 				.additionalParameters(authorizationCodeRequestAuthentication.getAdditionalParameters())
-				.consentRequired(authorizationCodeRequestAuthentication.isConsentRequired())
-				.consent(authorizationCodeRequestAuthentication.isConsent())
 				.authorizationCode(authorizationCodeRequestAuthentication.getAuthorizationCode());
 	}
 

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProviderTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 the original author or authors.
+ * Copyright 2020-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -1013,6 +1013,12 @@ public class OAuth2AuthorizationCodeRequestAuthenticationProviderTests {
 		OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication =
 				authenticationException.getAuthorizationCodeRequestAuthentication();
 		assertThat(authorizationCodeRequestAuthentication.getRedirectUri()).isEqualTo(redirectUri);
+
+		// gh-595
+		if (OAuth2ErrorCodes.ACCESS_DENIED.equals(errorCode)) {
+			assertThat(authorizationCodeRequestAuthentication.isConsent()).isFalse();
+			assertThat(authorizationCodeRequestAuthentication.isConsentRequired()).isFalse();
+		}
 	}
 
 	private static OAuth2AuthorizationCodeRequestAuthenticationToken.Builder authorizationCodeRequestAuthentication(