Improve minimal auto-configuration for OIDC login with Okta

Spring Boot supports common OAuth2 providers (facebook, github, google and okta), and provide a set of defaults for those providers. It works really well, I can do:

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: MY_CLIENT_ID.apps.googleusercontent.com
            client-secret: MY_CLIENT_SECRET

However, Okta is a bit more involved, because I get my own subdomain, so there are no "default" URIs for authorization/token/jwks, etc.

So I have to do something like:

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: MY_CLIENT_ID
            client-secret: MY_CLIENT_SECRET
        provider:
          okta:
            authorization-uri: https://MY_SUBDOMAIN.okta.com/oauth2/default/v1/authorize
            token-uri: https://MY_SUBDOMAIN.okta.com/oauth2/default/v1/token
            jwk-set-uri: https://MY_SUBDOMAIN.okta.com/oauth2/default/v1/keys

Which is the minimal configuration for a functionning OIDC login, using Spring Security's CommonOAuth2Providers.

Okta also exposes an OIDC Discovery endpoint /.well-known/openid-configuration, so I would like to do:

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: MY_CLIENT_ID
            client-secret: MY_CLIENT_SECRET
        provider:
          okta:
            issuer-uri: https://MY_SUBDOMAIN.okta.com/oauth2/default

However, by doing so, I lose the access to everything defined in org.springframework.security.config.oauth2.client.CommonOAuth2Provider.OKTA, most crucially the scopes, which are required for OAuth 2.0 login.

This is because OAuth2ClientPropertiesRegistrationAdapter#getClientRegistration first gets the configuration from the issuer-uri, and only if that's not available, it tries to get the "Common provider". Using issuer-uri overrides everything in the "Common Provider".

I'm inclined to propose a PR for this,but I'm curious what are your thoughts on this first?

The idea would be to get the "Common provider" first, and the enhance it through issuer-uri auto-discovery. I'm a bit worried about the impact this would have on the other three "common providers", as your registration would have more information, coming from the discovery endpoint.

Start at OAuth2ClientPropertiesRegistrationAdapter#getClientRegistration and compare its issuer-uri handling with CommonOAuth2Provider.OKTA. Determine how discovery data could enhance, rather than replace, the common provider defaults. Done means Okta can use issuer-uri while retaining required scopes, without changing the behavior of the other common providers.