spring-projects / spring-projects/spring-security
Allow configuration of OAuth2LoginAuthenticationFilter.authenticationResultConverter
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
OAuth2LoginAuthenticationFilter has a authenticationResultConverter property (link to code). It would be nice if we could set it through HttpSecurity.oauth2Login configuration during SecurityFilterChain registration
Current Behavior
It seems there is no way to set it to a custom converter through HttpSecurity builder. I tried registering a custom Converter bean implementation for the same type but it wasn't auto-wired through the setter method. I guess oauth2 login configurer doesn't attempt to find a converter bean during initialization.
Context
What I am trying to do is, capture some request parameters during the oauth login authorization flow and then access them after successful authentication. I have a custom OAuth2AuthorizationRequestResolver which appends additional attributes to the OAuth2AuthorizationRequest. After successful authentication, OAuth2LoginAuthenticationFilter obtains a OAuth2LoginAuthenticationToken and converts it to a OAuth2AuthenticationToken. It seems, there is no way to access the OAuth2AuthorizationRequest afterwards. So I need to have a custom converter there.
I use a BeanPostProcessor as a workaround to set the converter which seems to be working fine. I just thought it would be nice to have it configurable as OAuth2LoginAuthenticationFilter already have a public setter for that property.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with OAuth2LoginAuthenticationFilter.java, especially its authenticationResultConverter setter, then trace the HttpSecurity.oauth2Login configuration entry point used during SecurityFilterChain registration. Determine where that setting can be exposed through the OAuth2 login configuration. Done means a custom converter can be supplied through HttpSecurity.oauth2Login rather than a BeanPostProcessor workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- api, authentication, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100