spring-projects / spring-projects/spring-security
Allow for extending OAuth2AuthorizedClient with additional parameters in the code grant flow
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
On successful authorization, the stored authorized client includes any additional parameters provided by the auth server during the code grant flow.
Current Behavior
OAuth2AuthorizationCodeGrantFilter currently creates a OAuth2AuthorizedClient directly and then saves it via the OAuth2AuthorizedClientRepository. It doesn't provide any means to include additional parameters from the authorization step. The OAuth2AuthorizationCodeAuthenticationToken has additionalParameters already.
As an example of how it could be modified to pass the parameters:
-
Extend OAuth2AuthorizedClient to include and additionalParameters map e.g.:
private Map<String, Object> additionalParameters = new HashMap<>(); -
Modify
OAuth2AuthorizationCodeGrantFilterto copy theadditionalParametersfrom theOAuth2AuthorizationCodeAuthenticationTokento theOAuth2AuthorizedClient
Context
I'm using an API that includes a couple of extra parameters in the code grant flow and the client needs to include these parameters in headers in order to use the API. I can't currently see a way to get those parameters stored with the authorized client without re-writing the filter.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading OAuth2AuthorizedClient, OAuth2AuthorizationCodeGrantFilter, and OAuth2AuthorizationCodeAuthenticationToken to trace how authorization results are stored. Verify how OAuth2AuthorizedClientRepository receives the client and define completion as preserving the authorization step's additional parameters for later API use; the payload names no test file or command.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100