spring-projects / spring-projects/spring-security

Allow configuration of OAuth2LoginAuthenticationFilter.authenticationResultConverter

Open
#16,349 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

OAuth2LoginAuthenticationFilter has a authenticationResultConverter property (link to code). It would be nice if we could set it through HttpSecurity.oauth2Login configuration during SecurityFilterChain registration

Current Behavior

It seems there is no way to set it to a custom converter through HttpSecurity builder. I tried registering a custom Converter bean implementation for the same type but it wasn't auto-wired through the setter method. I guess oauth2 login configurer doesn't attempt to find a converter bean during initialization.

Context

What I am trying to do is, capture some request parameters during the oauth login authorization flow and then access them after successful authentication. I have a custom OAuth2AuthorizationRequestResolver which appends additional attributes to the OAuth2AuthorizationRequest. After successful authentication, OAuth2LoginAuthenticationFilter obtains a OAuth2LoginAuthenticationToken and converts it to a OAuth2AuthenticationToken. It seems, there is no way to access the OAuth2AuthorizationRequest afterwards. So I need to have a custom converter there.

I use a BeanPostProcessor as a workaround to set the converter which seems to be working fine. I just thought it would be nice to have it configurable as OAuth2LoginAuthenticationFilter already have a public setter for that property.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with OAuth2LoginAuthenticationFilter.java, especially its authenticationResultConverter setter, then trace the HttpSecurity.oauth2Login configuration entry point used during SecurityFilterChain registration. Determine where that setting can be exposed through the OAuth2 login configuration. Done means a custom converter can be supplied through HttpSecurity.oauth2Login rather than a BeanPostProcessor workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
api, authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.