CODEWITHSUNDEEP
springspring-securityspring-security-oauth2
Robin Hermans
Robin Hermans

Reputation: 1599

How can I extend the parameters of the OAuth2 authorization endpoint?

I'm having some trouble regarding the authorization endpoint of my Spring based OAuth2 provider. I need more information from the client than there is currently possible. This is what I want to achieve:

custom parameter

I need the custom parameter in the authentication process later on. Is there any simple way to extend the default parameters with my custom one or do I need to implement a certain class myself?

Did some research on how the authentication endpoint works in the current Spring code. I found that the Authorization Endpoint uses a method named authorize that takes all the parameter that are being set and converts then into an AuthorizationRequest. While looking further into the AuthorizationRequest class I found that it holds a map with extensions that is being filled throughout the authorization process. But it does not seem to get filled with my custom parameter (as shown above). This is in fact by only looking at the code, so I might be wrong.

Would it be a good idea to extend the AuthorizationEndpoint with my custom implementation or is there a better and cleaner way to do this?

Update #1 (07-10-2015)

The place where I'd like to use the custom parameter is in my own implementation of the AuthenticationProvider. I need to information to be available inside the authenticate method of this class.

Update #2 (07-10-2015)

It seems that the AuthorizationProvider gets called before the AuthorizationEndpoint. This means that the custom parameter is obtained after the class where I need it (so that's too late).

enter image description here

Maybe I can get the referral Url by either extending part of the Spring security classes or by obtaining it in the HTML through JavaScript. Is this a good idea or should I use another approach?

Upvotes: 3

Views: 1787

Answers (1)

Robin Hermans
Robin Hermans

Reputation: 1599

So I managed to fix the problem myself by searching some more on Google. What you need to do is speak to the HttpSessionRequestCache to get the referral URL. This is how I solved it in my own implementation of the AuthenticationProvider

@Component
public class CustomProvider implements AuthenticationProvider {

  @Autowired
  private HttpServletRequest httpRequest;

  @Autowired
  private HttpServletResponse httpResponse;

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {

    SavedRequest savedRequest = new HttpSessionRequestCache().getRequest(httpRequest, httpResponse);
    logger.info("Referral URL: " + savedRequest.getRedirectUrl());
    logger.info("Parameters: " + savedRequest.getParameterMap().keySet().toString());

  }

}

This will print out the URL of the request that was called before heading to the login page of spring security. The second log method prints out the parameters that where found in this URL. This question and answer helped me in creating a solution for my problem.

Upvotes: 3

Related Questions