spring-projects / spring-projects/spring-security
Additional attributes for ClientRegistration and ProviderDetails
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
New Behavior
I'd like the ability to attach additional attributes/properties to ClientRegistrations and ProviderDetails, so that it can be utilized by ReactiveOAuth2AccessTokenResponseClients and OAuth2AccessTokenResponseClients when requesting tokens.
For example, when configuring ClientRegistrations or Providers via spring-boot auto configuration, I'd like the ability to do something like this:
spring:
security:
oauth2:
client:
provider:
my-provider:
issuer-uri: https://my-issuer
# New Feature: Custom Attributes
attributes:
my-custom-provider-attribute: my-custom-provider-attribute-value
registration:
my-client:
provider: my-provider
client-id: my-client-id
client-secret: my-client-secret
client-authentication-method: basic
authorization-grant-type: client_credentials
scope:
- my.scope.1
- my.scope.2
# New Feature: Custom Attributes
attributes:
my-custom-registration-attribute: my-custom-registration-attribute-value
And ClientRegistration and ProviderDetails would each have an additional Map<String, Object> attributes property.
Current Behavior
ClientRegistrations and ProviderDetails only support the standard set of attributes/metadata/properties that are utilized by the standard ReactiveOAuth2AccessTokenResponseClients and OAuth2AccessTokenResponseClients
Context
We're utilizing an OAuth 2.0 Authorization Server that supports some additional, non-standard, inputs when requesting tokens. One example is that it supports an input parameter that determines the type of token to return... opaque token or JWT.
In order to support this input, I currently customize the WebClient used by ReactiveOAuth2AccessTokenResponseClient with a custom filter that adds the additional form inputs statically, applying the same values for every request for all client registrations. I'd like for the filter to be able to inspect additional attributes/properties defined on each ClientRegistration or ProviderDetails in order to determine what inputs to add. I know I could create a separate, parallel, set of configuration properties for each client registration and provider, but that gets pretty messy from a configuration property standpoint, and from a spring-boot auto-configuration standpoint. Having first-class support for custom attributes on the client registrations and providers would simplify configuration, and be more intuitive.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with ClientRegistration and ProviderDetails, then trace how ReactiveOAuth2AccessTokenResponseClient and OAuth2AccessTokenResponseClient consume them. Determine how provider and registration attributes should flow from Spring Boot configuration into token requests, and verify the behavior for both client types.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100