Follow the instructions on the OpenID Connect page, starting in the “Setting up OAuth 2.0” section.

After completing the “Obtain OAuth 2.0 credentials” instructions, you should have new OAuth Client with credentials consisting of a Client ID and a Client Secret.

Setting the Redirect URI

The redirect URI is the path in the application that the end-user’s user-agent is redirected back to after they have authenticated with Google and have granted access to the OAuth Client ( created in the previous step ) on the Consent page.

In the “Set a redirect URI” subsection, ensure that the Authorized redirect URIs field is set to localhost:8080/login/oauth2/code/google .

If the OAuth Client runs behind a proxy server, you should check the Proxy Server Configuration to ensure the application is correctly configured. Also, see the supported URI template variables for redirect-uri .

Configure application.yml

Launch the Spring Boot 2.x sample and go to localhost:8080 . You are then redirected to the default auto-generated login page, which displays a link for Google.

Click on the Google link, and you are then redirected to Google for authentication.

After authenticating with your Google account credentials, you see the Consent screen. The Consent screen asks you to either allow or deny access to the OAuth Client you created earlier. Click Allow to authorize the OAuth Client to access your email address and basic profile information.

At this point, the OAuth Client retrieves your email address and basic profile information from the UserInfo Endpoint and establishes an authenticated session.

spring.security.oauth2.client.registration. [registrationId] .client-authentication-method

clientAuthenticationMethod

spring.security.oauth2.client.registration. [registrationId] .authorization-grant-type

authorizationGrantType

spring.security.oauth2.client.registration. [registrationId] .redirect-uri

redirectUri

spring.security.oauth2.client.registration. [registrationId] .scope

scopes

spring.security.oauth2.client.registration. [registrationId] .client-name

clientName

spring.security.oauth2.client.provider. [providerId] .authorization-uri

providerDetails.authorizationUri

spring.security.oauth2.client.provider. [providerId] .token-uri

providerDetails.tokenUri

spring.security.oauth2.client.provider. [providerId] .jwk-set-uri

providerDetails.jwkSetUri

spring.security.oauth2.client.provider. [providerId] .issuer-uri

providerDetails.issuerUri

spring.security.oauth2.client.provider. [providerId] .user-info-uri

providerDetails.userInfoEndpoint.uri

spring.security.oauth2.client.provider. [providerId] .user-info-authentication-method

providerDetails.userInfoEndpoint.authenticationMethod

spring.security.oauth2.client.provider. [providerId] .user-name-attribute

providerDetails.userInfoEndpoint.userNameAttributeName

CommonOAuth2Provider pre-defines a set of default client properties for a number of well known providers: Google, GitHub, Facebook, and Okta.

For example, the authorization-uri , token-uri , and user-info-uri do not change often for a provider. Therefore, it makes sense to provide default values, to reduce the required configuration.

As demonstrated previously, when we configured a Google client , only the client-id and client-secret properties are required.

The following listing shows an example:

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: google-client-id
            client-secret: google-client-secret

For cases where you may want to specify a different registrationId , such as google-login , you can still leverage auto-defaulting of client properties by configuring the provider property.

The following listing shows an example:

spring:
  security:
    oauth2:
      client:
        registration:
          google-login:	(1)
            provider: google	(2)
            client-id: google-client-id
            client-secret: google-client-secret

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: okta-client-id
            client-secret: okta-client-secret
        provider:
          okta:	(1)
            authorization-uri: https://your-subdomain.oktapreview.com/oauth2/v1/authorize
            token-uri: https://your-subdomain.oktapreview.com/oauth2/v1/token
            user-info-uri: https://your-subdomain.oktapreview.com/oauth2/v1/userinfo
            user-name-attribute: sub
            jwk-set-uri: https://your-subdomain.oktapreview.com/oauth2/v1/keys

<http auto-config="true">
	<intercept-url pattern="/**" access="authenticated"/>
	<oauth2-login authorized-client-repository-ref="authorizedClientRepository"/>
</http>
<client-registrations>
	<client-registration registration-id="google"
						 client-id="google-client-id"
						 client-secret="google-client-secret"
						 provider-id="google"/>
</client-registrations>
<b:bean id="authorizedClientService"
		class="org.springframework.security.oauth2.client.InMemoryOAuth2AuthorizedClientService"
		autowire="constructor"/>
<b:bean id="authorizedClientRepository"
		class="org.springframework.security.oauth2.client.web.AuthenticatedPrincipalOAuth2AuthorizedClientRepository">
	<b:constructor-arg ref="authorizedClientService"/>
</b:bean>