public OAuth2LoginConfigurer<HttpSecurity> oauth2Login()
                                                throws java.lang.Exception

Configures authentication against an external OAuth 2.0 or OpenID Connect 1.0 Provider. The "authentication flow" is realized using the Authorization Code Grant , as specified in the OAuth 2.0 Authorization Framework . As a prerequisite to using this feature, the developer must register a Client with an Authorization Server . The output of the Client Registration process results in a number of properties that are then used for configuring an instance of a ClientRegistration . Properties specific to a Client include: client_id , client_secret , scope , redirect_uri , etc. There are also properties specific to the Provider , for example, Authorization Endpoint URI , Token Endpoint URI , UserInfo Endpoint URI , etc. Multiple client support is provided for use cases where the application provides the user the option for "Logging in" against one or more Providers, for example, Google , GitHub , Facebook , etc. ClientRegistration (s) are composed within a ClientRegistrationRepository . An instance of ClientRegistrationRepository is required and may be supplied via the ApplicationContext or configured using OAuth2LoginConfigurer.clients(org.springframework.security.oauth2.client.registration.ClientRegistrationRepository) . The default configuration provides an auto-generated login page at "/login" and redirects to "/login?error" when an authentication error occurs. The login page will display each of the clients (composed within the ClientRegistrationRepository ) with an anchor link to "/oauth2/authorization/code/{clientAlias}" . Clicking through the link will initiate the "Authorization Request" flow redirecting the end-user's user-agent to the Authorization Endpoint of the Provider . Assuming the Resource Owner (end-user) grants the Client access, the Authorization Server will redirect the end-user's user-agent to the Redirection Endpoint containing the Authorization Code - the Redirection Endpoint is automatically configured for the application and defaults to "/oauth2/authorize/code/{clientAlias}" . At this point in the "authentication flow" , the configured AuthorizationGrantTokenExchanger will exchange the Authorization Code for an Access Token and then use it to access the protected resource at the UserInfo Endpoint (via OAuth2UserService ) in order to retrieve the details of the Resource Owner (end-user) and establish the "authenticated" session.

Example Configurations

The minimal configuration defaults to automatically generating a login page at "/login" and redirecting to "/login?error" when an authentication error occurs or redirecting to "/" when an authenticated session is established. @EnableWebSecurity public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { .authorizeRequests() .anyRequest().authenticated() .and() .oauth2Login(); @Bean public ClientRegistrationRepository clientRegistrationRepository() { // ClientRegistrationRepositoryImpl must be composed of at least one ClientRegistration instance return new ClientRegistrationRepositoryImpl(); The following shows the configuration options available for customizing the defaults. @EnableWebSecurity public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { .authorizeRequests() .anyRequest().authenticated() .and() .oauth2Login() .clients(this.clientRegistrationRepository()) .authorizationRequestBuilder(this.authorizationRequestBuilder()) .authorizationCodeTokenExchanger(this.authorizationCodeTokenExchanger()) .userInfoEndpoint() .userInfoService(this.userInfoService()) .userInfoEndpoint() // Provide a mapping between a Converter implementation and a UserInfo Endpoint URI .userInfoTypeConverter(this.userInfoConverter(), new URI("https://www.googleapis.com/oauth2/v3/userinfo")); @Bean public ClientRegistrationRepository clientRegistrationRepository() { // ClientRegistrationRepositoryImpl must be composed of at least one ClientRegistration instance return new ClientRegistrationRepositoryImpl(); @Bean public AuthorizationRequestUriBuilder authorizationRequestBuilder() { // Custom URI builder for the "Authorization Request" return new AuthorizationRequestUriBuilderImpl(); @Bean public AuthorizationGrantTokenExchanger<AuthorizationCodeAuthenticationToken> authorizationCodeTokenExchanger() { // Custom implementation that exchanges an "Authorization Code Grant" for an "Access Token" return new AuthorizationCodeTokenExchangerImpl(); @Bean public OAuth2UserService userInfoService() { // Custom implementation that retrieves the details of the authenticated user at the "UserInfo Endpoint" return new OAuth2UserServiceImpl(); @Bean public Converter<ClientHttpResponse, UserInfo> userInfoConverter() { // Default converter implementation for UserInfo return new org.springframework.security.oauth2.client.user.converter.UserInfoConverter();

Returns:

the OAuth2LoginConfigurer for further customizations

Throws:

java.lang.Exception

Since:

See Also:

Section 4.1 Authorization Code Grant Flow , Section 4.1.1 Authorization Request , Section 4.1.2 Authorization Response , ClientRegistration , ClientRegistrationRepository , AuthorizationRequestUriBuilder , AuthorizationGrantTokenExchanger , OAuth2UserService

requiresChannel

public ChannelSecurityConfigurer.ChannelRequestMatcherRegistry requiresChannel()
                                                                        throws java.lang.Exception