java 50 lines · 8 steps

How OIDC login works in Spring Security

A Spring Security config wires up OAuth2/OIDC login and enriches the authenticated user with a custom role based on claims.

Explained by highlit

Spring Intermediate oauth2 openid-connect authorization authentication security-filter-chain

1@Configuration
2@EnableWebSecurity
3public class OAuth2SecurityConfig {
4 
  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
      http
          .authorizeHttpRequests(auth -> auth
              .requestMatchers("/", "/error", "/webjars/**").permitAll()
              .anyRequest().authenticated()
          )
          .oauth2Login(oauth2 -> oauth2
              .userInfoEndpoint(userInfo -> userInfo
                  .oidcUserService(this.oidcUserService())
              )
              .defaultSuccessUrl("/dashboard", true)
          )
          .logout(logout -> logout
              .logoutSuccessUrl("/")
              .clearAuthentication(true)
          );
      return http.build();
  }
24 
  private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService() {
      OidcUserService delegate = new OidcUserService();
      return userRequest -> {
          OidcUser oidcUser = delegate.loadUser(userRequest);
          String registrationId = userRequest.getClientRegistration().getRegistrationId();
          Set<GrantedAuthority> authorities = new LinkedHashSet<>(oidcUser.getAuthorities());
          if (Boolean.TRUE.equals(oidcUser.getClaimAsBoolean("email_verified"))) {
              authorities.add(new SimpleGrantedAuthority("ROLE_VERIFIED"));
          }
          return new DefaultOidcUser(authorities, oidcUser.getIdToken(), oidcUser.getUserInfo());
      };
  }
37}
38 
39@Controller
40class DashboardController {
41 
  @GetMapping("/dashboard")
  public String dashboard(@AuthenticationPrincipal OidcUser principal, Model model) {
      model.addAttribute("name", principal.getFullName());
      model.addAttribute("email", principal.getEmail());
      model.addAttribute("picture", principal.getClaimAsString("picture"));
      model.addAttribute("issuer", principal.getIssuer());
      return "dashboard";
  }
50}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1A SecurityFilterChain bean is where you declare which routes are public and how login and logout behave.
2Wrapping the default OidcUserService lets you add custom authorities derived from token claims.
3Once login succeeds, the OidcUser can be injected straight into controllers as the authentication principal.

Related explainers

java

public final class IbanValidator {
 
    private static final Map<String, Integer> COUNTRY_LENGTHS = Map.ofEntries(
        Map.entry("DE", 22), Map.entry("FR", 27), Map.entry("GB", 22),

Validating IBANs with the mod-97 checksum

validation checksum modular-arithmetic

Intermediate 8 steps

php

<?php
 
namespace App\Http\Middleware;

Verifying GitHub webhook signatures in Laravel

middleware hmac webhooks

Intermediate 5 steps

java

@RestController
@RequestMapping("/api/reports")
public class OrderReportController {

Streaming a CSV export in Spring

streaming csv-export backpressure

Intermediate 9 steps

java

public class SlidingLogRateLimiter {
 
    private final int maxRequests;
    private final long windowMillis;

How a sliding-log rate limiter works

rate-limiting concurrency sliding-window

Advanced 8 steps

typescript

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';
import { ConfigService } from '@nestjs/config';

How a JWT strategy authenticates in NestJS

authentication jwt passport

Intermediate 7 steps

java

public final class Slugifier {
 
    private static final Pattern NON_LATIN = Pattern.compile("[^\\w-]");
    private static final Pattern WHITESPACE = Pattern.compile("[\\s]+");