oauth2Login().clientRegistrationRepository(..).
* "/login" and
* redirects to "/login?error" when an authentication error occurs.
- * The login page will display each of the clients (composed within the
- * {@link org.springframework.security.oauth2.client.registration.ClientRegistrationRepository})
- * with an anchor link to "/oauth2/authorization/code/{clientAlias}".
- * Clicking through the link will initiate the "Authorization Request" flow
- * redirecting the end-user's user-agent to the Authorization Endpoint of the Provider.
- * Assuming the Resource Owner (end-user) grants the Client access, the Authorization Server
- * will redirect the end-user's user-agent to the Redirection Endpoint containing the Authorization Code
- * - the Redirection Endpoint is automatically configured for the application and
- * defaults to "/oauth2/authorize/code/{clientAlias}".
+ * The login page will display each of the clients with a link
+ * that is capable of initiating the "authentication flow".
+ * - * At this point in the "authentication flow", the configured - * {@link OAuth2AccessTokenResponseClient} - * will getTokenResponse the Authorization Code for an Access Token and then use it to access the protected resource - * at the UserInfo Endpoint in order to retrieve the details of the Resource Owner (end-user) and establish the - * "authenticated" session. + *
"/login"
- * and redirecting to "/login?error" when an authentication error occurs or redirecting to
- * "/" when an authenticated session is established.
+ * The following example shows the minimal configuration required, using Google as the Authentication Provider.
*
*
- * @EnableWebSecurity
- * public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
+ * @Configuration
+ * public class OAuth2LoginConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
- * http
- * .authorizeRequests()
- * .anyRequest().authenticated()
- * .and()
- * .oauth2Login();
- * }
+ * @EnableWebSecurity
+ * public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
+ * @Override
+ * protected void configure(HttpSecurity http) throws Exception {
+ * http
+ * .authorizeRequests()
+ * .anyRequest().authenticated()
+ * .and()
+ * .oauth2Login();
+ * }
+ * }
*
* @Bean
* public ClientRegistrationRepository clientRegistrationRepository() {
- * // ClientRegistrationRepositoryImpl must be composed of at least one ClientRegistration instance
- * return new ClientRegistrationRepositoryImpl();
+ * return new InMemoryClientRegistrationRepository(this.googleClientRegistration());
+ * }
+ *
+ * private ClientRegistration googleClientRegistration() {
+ * return ClientRegistration.withRegistrationId("google")
+ * .clientId("google-client-id")
+ * .clientSecret("google-client-secret")
+ * .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
+ * .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
+ * .redirectUriTemplate("{baseUrl}/login/oauth2/code/{registrationId}")
+ * .scope("openid", "profile", "email", "address", "phone")
+ * .authorizationUri("https://accounts.google.com/o/oauth2/v2/auth")
+ * .tokenUri("https://www.googleapis.com/oauth2/v4/token")
+ * .userInfoUri("https://www.googleapis.com/oauth2/v3/userinfo")
+ * .userNameAttributeName(IdTokenClaimNames.SUB)
+ * .jwkSetUri("https://www.googleapis.com/oauth2/v3/certs")
+ * .clientName("Google")
+ * .build();
* }
* }
*
*
- * The following shows the configuration options available for customizing the defaults.
- *
- *
- * @EnableWebSecurity
- * public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
- *
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
- * http
- * .authorizeRequests()
- * .anyRequest().authenticated()
- * .and()
- * .oauth2Login()
- * .clientRegistrationRepository(this.clientRegistrationRepository())
- * .authorizationRequestUriBuilder(this.authorizationRequestUriBuilder())
- * .accessTokenResponseClient(this.accessTokenResponseClient())
- * .userInfoEndpoint()
- * .userInfoService(this.userInfoService())
- * .userInfoEndpoint()
- * // Provide a mapping between a Converter implementation and a UserInfo Endpoint URI
- * .userInfoTypeConverter(this.userInfoConverter(),
- * new URI("https://www.googleapis.com/oauth2/v3/userinfo"));
- * }
- *
- * @Bean
- * public ClientRegistrationRepository clientRegistrationRepository() {
- * // ClientRegistrationRepositoryImpl must be composed of at least one ClientRegistration instance
- * return new ClientRegistrationRepositoryImpl();
- * }
- *
- * @Bean
- * public AuthorizationRequestUriBuilder authorizationRequestUriBuilder() {
- * // Custom URI builder for the "Authorization Request"
- * return new AuthorizationRequestUriBuilderImpl();
- * }
- *
- * @Bean
- * public OAuth2AccessTokenResponseClient<OAuth2LoginAuthenticationToken> accessTokenResponseClient() {
- * // Custom implementation that exchanges an "Authorization Code Grant" for an "Access Token"
- * return new AuthorizationCodeTokenExchangerImpl();
- * }
- *
- * @Bean
- * public OAuth2UserService userInfoService() {
- * // Custom implementation that retrieves the details of the authenticated user at the "UserInfo Endpoint"
- * return new OAuth2UserServiceImpl();
- * }
- *
- * @Bean
- * public Converter<ClientHttpResponse, UserInfo> userInfoConverter() {
- * // Default converter implementation for UserInfo
- * return new org.springframework.security.oauth2.client.user.converter.UserInfoConverter();
- * }
- * }
- *
+ * + * For more advanced configuration, see {@link OAuth2LoginConfigurer} for available options to customize the defaults. * * @author Joe Grandja * @since 5.0 - * @see Section 4.1 Authorization Code Grant Flow - * @see Section 4.1.1 Authorization Request - * @see Section 4.1.2 Authorization Response + * @see Section 4.1 Authorization Code Grant + * @see Section 3.1 Authorization Code Flow * @see org.springframework.security.oauth2.client.registration.ClientRegistration * @see org.springframework.security.oauth2.client.registration.ClientRegistrationRepository - * @see OAuth2AccessTokenResponseClient - * @see org.springframework.security.oauth2.client.user.OAuth2UserService - * * @return the {@link OAuth2LoginConfigurer} for further customizations * @throws Exception */