spring-projects / spring-projects/spring-security

Additional attributes for ClientRegistration and ProviderDetails

Open
#9,669 9 comments 9 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

in: oauth2 type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

New Behavior

I'd like the ability to attach additional attributes/properties to ClientRegistrations and ProviderDetails, so that it can be utilized by ReactiveOAuth2AccessTokenResponseClients and OAuth2AccessTokenResponseClients when requesting tokens.

For example, when configuring ClientRegistrations or Providers via spring-boot auto configuration, I'd like the ability to do something like this:

spring:
  security:
    oauth2:
      client:
        provider:
          my-provider:
            issuer-uri: https://my-issuer
            # New Feature: Custom Attributes
            attributes:
              my-custom-provider-attribute: my-custom-provider-attribute-value
        registration:
          my-client:
            provider: my-provider
            client-id: my-client-id
            client-secret: my-client-secret
            client-authentication-method: basic
            authorization-grant-type: client_credentials
            scope:
              - my.scope.1
              - my.scope.2
            # New Feature: Custom Attributes
            attributes:
              my-custom-registration-attribute: my-custom-registration-attribute-value

And ClientRegistration and ProviderDetails would each have an additional Map<String, Object> attributes property.

Current Behavior

ClientRegistrations and ProviderDetails only support the standard set of attributes/metadata/properties that are utilized by the standard ReactiveOAuth2AccessTokenResponseClients and OAuth2AccessTokenResponseClients

Context

We're utilizing an OAuth 2.0 Authorization Server that supports some additional, non-standard, inputs when requesting tokens. One example is that it supports an input parameter that determines the type of token to return... opaque token or JWT.

In order to support this input, I currently customize the WebClient used by ReactiveOAuth2AccessTokenResponseClient with a custom filter that adds the additional form inputs statically, applying the same values for every request for all client registrations. I'd like for the filter to be able to inspect additional attributes/properties defined on each ClientRegistration or ProviderDetails in order to determine what inputs to add. I know I could create a separate, parallel, set of configuration properties for each client registration and provider, but that gets pretty messy from a configuration property standpoint, and from a spring-boot auto-configuration standpoint. Having first-class support for custom attributes on the client registrations and providers would simplify configuration, and be more intuitive.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with ClientRegistration and ProviderDetails, then trace how ReactiveOAuth2AccessTokenResponseClient and OAuth2AccessTokenResponseClient consume them. Determine how provider and registration attributes should flow from Spring Boot configuration into token requests, and verify the behavior for both client types.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.