Cannot set custom userInfoEndpoint user/oidc user service

[bdemers]

This is caused by the use of a factory configured in META-INF/spring.factories

org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer = \
  com.okta.spring.boot.oauth.OktaOAuth2Configurer

Maybe we can change this logic to lookup a bean from the context instead. Otherwise, we might need to provide some other way to allow custom Authorities to be added to the current user.

[bdemers]

(possibly getting the current context similar to this: https://github.com/okta/okta-spring-boot/blob/master/oauth2/src/main/java/com/okta/spring/boot/oauth/OktaOAuth2Configurer.java#L46)

[jkennedy4]

My use case for injecting my own code in the spring boot + oauth + okta flow is as follows. We will be supporting 3 different types of applications on our side: a legacy (JBOSS) app with spring xml-config and custom "homegrown" security, a JBOSS app with spring security and a spring boot app. We would like to add information to the OAuth2AuthenticationToken which is the object ultimately returned by Spring. We would like to add our own authorities to the existing ones added by oauth/okta. Also, we need to add a custom security user object to the http session which is used by the legacy app. This information comes from our Oracle database, and we will use the loginId (from Okta) as a key to lookup the Oracle data. That means our code HAS to follow the back-channel calls that are initiated from Spring's OidcAuthorizationCodeAuthenticationProvider.

[bdemers]

@jkennedy4 Thanks that helps!

[msamm-r7]

i have a very similar use case to @jkennedy4 , where i want to add to the authorities during auth.

[luupqvinh]

I have the same problem. I want to provide a custom oidc user service to add some custom authorities by querying a database.

[bdemers]

Anyone watching this issue, I just created a PR with how I've been thinking about solving this. Feedback welcome!

TL;DR:

@Bean
AuthoritiesProvider myCustomAuthoritiesProvider() {
    return (user, userRequest) -> lookupExtraAuthoritesByName(user.getAttributes().get("email"));
}

(There is still a little bit of cleanup to do on this PR, but I think it should provide an easy way to add custom GrantedAuthorites)

[dcods22]

Is there an update as to when this change would be in?

[bdemers]

@dcods22 Can you take a look at #146 ? Would something like that work for you?

(I'm also trying to make sure you can set the UserServices as well)

[dcods22]

@bdemers Yes that would work. Like you mentioned setting the user service would be super ideal too and would remove the need for this Authorities providers since you could then just override the user service that could extend off of yours and only override those methods. But this change would at least unblock us for now and let us leverage spring security properly which is ideal

[jevanlingen]

#146 added the authoritiesProviders to OktaOidcUserService and OktaOAuth2UserService classes. I am missing something, or should it also be added to the OktaJwtAuthenticationConverter class as well? I got a JWT token, but once it is validated it does not seem to cross named services, so I cannot set my own authorities for tokenized login users.

Edit: Did not check the other issues, but this comment clearly a duplicate with #160!

[bdemers]

@jevanlingen +1
Let's move this conversation over to #160