OAuth2: auto-redirect if only one provider is configured still redirects to login page.

Summary

Oauth2
Auto-redirect if there is only one provider configured does not work.

Actual Behavior

Redirect to login page

Expected Behavior

redirect to provider

Configuration

See example https://github.com/elch78/spring-security-7586.git

Version

5.1.6.RELEASE

Sample

I've debugged the code and found these 2 places

This one works as expected
OAuth2LoginConfigurer.init()

if (loginUrlToClientName.size() == 1) { // Setup auto-redirect to provider login page // when only 1 client is configured this.updateAuthenticationDefaults(); this.updateAccessDefaults(http); String providerLoginPage = loginUrlToClientName.keySet().iterator().next(); this.registerAuthenticationEntryPoint(http, this.getLoginEntryPoint(http, providerLoginPage)); }

This one is probably the one with the bug. It's invoked with providerLoginPage=/oauth2/authorization/ciam which is correct I guess. Ciam is our IDP.

OAuth2LoginConfigurer

` private AuthenticationEntryPoint getLoginEntryPoint(B http, String providerLoginPage) {
RequestMatcher loginPageMatcher = new AntPathRequestMatcher(this.getLoginPage());
RequestMatcher faviconMatcher = new AntPathRequestMatcher("/favicon.ico");
RequestMatcher defaultEntryPointMatcher = this.getAuthenticationEntryPointMatcher(http);
RequestMatcher defaultLoginPageMatcher = new AndRequestMatcher(
new OrRequestMatcher(loginPageMatcher, faviconMatcher), defaultEntryPointMatcher);

	RequestMatcher notXRequestedWith = new NegatedRequestMatcher(
			new RequestHeaderRequestMatcher("X-Requested-With", "XMLHttpRequest"));

	LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints = new LinkedHashMap<>();
	entryPoints.put(new AndRequestMatcher(notXRequestedWith, new NegatedRequestMatcher(defaultLoginPageMatcher)),
			new LoginUrlAuthenticationEntryPoint(providerLoginPage));

	DelegatingAuthenticationEntryPoint loginEntryPoint = new DelegatingAuthenticationEntryPoint(entryPoints);
	loginEntryPoint.setDefaultEntryPoint(this.getAuthenticationEntryPoint());

	return loginEntryPoint;
}`

The last line results in setDefaultEntryPoint with LoginUrlAuthenticationEntryPoint and loginFormUrl="/login"

Start with OAuth2LoginConfigurer.init() and its getLoginEntryPoint() method, using the linked example repository to reproduce the single-provider OAuth2 configuration. Trace the AuthenticationEntryPoint selection and verify that an unauthenticated request redirects to /oauth2/authorization/ciam rather than /login; the fix is complete when that behavior is covered by the relevant Spring Security tests.