spring-projects / spring-projects/spring-security

Allow for extending OAuth2AuthorizedClient with additional parameters in the code grant flow

Open
#15,470 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

On successful authorization, the stored authorized client includes any additional parameters provided by the auth server during the code grant flow.

Current Behavior

OAuth2AuthorizationCodeGrantFilter currently creates a OAuth2AuthorizedClient directly and then saves it via the OAuth2AuthorizedClientRepository. It doesn't provide any means to include additional parameters from the authorization step. The OAuth2AuthorizationCodeAuthenticationToken has additionalParameters already.

As an example of how it could be modified to pass the parameters:

  1. Extend OAuth2AuthorizedClient to include and additionalParameters map e.g.: private Map<String, Object> additionalParameters = new HashMap<>();

  2. Modify OAuth2AuthorizationCodeGrantFilter to copy the additionalParameters from the OAuth2AuthorizationCodeAuthenticationToken to the OAuth2AuthorizedClient

Context

I'm using an API that includes a couple of extra parameters in the code grant flow and the client needs to include these parameters in headers in order to use the API. I can't currently see a way to get those parameters stored with the authorized client without re-writing the filter.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading OAuth2AuthorizedClient, OAuth2AuthorizationCodeGrantFilter, and OAuth2AuthorizationCodeAuthenticationToken to trace how authorization results are stored. Verify how OAuth2AuthorizedClientRepository receives the client and define completion as preserving the authorization step's additional parameters for later API use; the payload names no test file or command.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.