spring-projects / spring-projects/spring-security
Need to be able to customize auto-approved scopes in Authorization server
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
In Consent related implementation:
org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationConsentAuthenticationProvider#authenticate there is implementation which adds OPENID scope if it's not given - so it's let say "auto-added"
I need to be able to provide arbitrary list of such scopes which are auto added
Current Behavior
To achieve the above, i would need to replace whole class OAuth2AuthorizationConsentAuthenticationProvider, copy the code and add my extension
Context
I need to add to user's access token, scopes which are not known at the point of calling "authorize" endpoint. They are derived from user profile, In particular from the list of organizations which user is allowed to access
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with OAuth2AuthorizationConsentAuthenticationProvider#authenticate in the package named by the issue and trace how OPENID is auto-added during consent handling. Define what extension point or configuration would allow an arbitrary list of auto-approved scopes without replacing the provider, while preserving the existing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100