Authorization Server & Social Login

@Configuration
public class AuthorizationServerConfig {

    @Bean
    @Order(1)
    SecurityFilterChain authorizationServerChain(HttpSecurity http) throws Exception {
        OAuth2AuthorizationServerConfigurer authorizationServer =
                OAuth2AuthorizationServerConfigurer.authorizationServer();

        http
            .securityMatcher(authorizationServer.getEndpointsMatcher())
            .with(authorizationServer, server -> server
                .oidc(Customizer.withDefaults()))          // enable the OIDC endpoints
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .exceptionHandling(ex -> ex
                .defaultAuthenticationEntryPointFor(
                    new LoginUrlAuthenticationEntryPoint("/login"),
                    new MediaTypeRequestMatcher(MediaType.TEXT_HTML)))
            .oauth2ResourceServer(rs -> rs.jwt(Customizer.withDefaults()));   // for /userinfo, /connect/register
        return http.build();
    }

    @Bean
    @Order(2)
    SecurityFilterChain appChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
            .formLogin(Customizer.withDefaults());         // and/or .oauth2Login(...) for social login
        return http.build();
    }
}

RegisteredClient webApp = RegisteredClient.withId(UUID.randomUUID().toString())
        .clientId("web-app")
        .clientSecret("{bcrypt}$2a$10$...")                        // client_secret_basic
        .clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
        .authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
        .redirectUri("https://app.example.com/login/oauth2/code/web-app")
        .postLogoutRedirectUri("https://app.example.com/")
        .scope(OidcScopes.OPENID)
        .scope(OidcScopes.PROFILE)
        .scope("read")
        .clientSettings(ClientSettings.builder()
                .requireAuthorizationConsent(true)
                .build())
        .tokenSettings(TokenSettings.builder()
                .accessTokenTimeToLive(Duration.ofMinutes(15))
                .refreshTokenTimeToLive(Duration.ofDays(30))
                .accessTokenFormat(OAuth2TokenFormat.SELF_CONTAINED)   // JWT; REFERENCE = opaque
                .build())
        .build();

RegisteredClient spa = RegisteredClient.withId(UUID.randomUUID().toString())
        .clientId("spa")
        .clientAuthenticationMethod(ClientAuthenticationMethod.NONE)    // public client
        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
        .redirectUri("https://spa.example.com/callback")
        .scope(OidcScopes.OPENID)
        .clientSettings(ClientSettings.builder()
                .requireProofKey(true)                                 // PKCE required
                .build())
        .build();

spring:
  security:
    oauth2:
      authorizationserver:
        issuer: https://auth.example.com
        client:
          web-app:
            registration:
              client-id: web-app
              client-secret: "{bcrypt}$2a$10$..."
              client-authentication-methods: client_secret_basic
              authorization-grant-types: [authorization_code, refresh_token]
              redirect-uris: [https://app.example.com/login/oauth2/code/web-app]
              post-logout-redirect-uris: [https://app.example.com/]
              scopes: [openid, profile, read]
            require-authorization-consent: true
            token:
              access-token-time-to-live: 15m
              refresh-token-time-to-live: 30d
          spa:
            registration:
              client-id: spa
              client-authentication-methods: none
              authorization-grant-types: [authorization_code]
              redirect-uris: [https://spa.example.com/callback]
              scopes: [openid]
            require-proof-key: true

CREATE TABLE oauth2_registered_client (
    id                            varchar(100)  NOT NULL,
    client_id                     varchar(100)  NOT NULL,
    client_id_issued_at           timestamp     NOT NULL DEFAULT CURRENT_TIMESTAMP,
    client_secret                 varchar(200)  DEFAULT NULL,
    client_secret_expires_at      timestamp     DEFAULT NULL,
    client_name                   varchar(200)  NOT NULL,
    client_authentication_methods varchar(1000) NOT NULL,
    authorization_grant_types     varchar(1000) NOT NULL,
    redirect_uris                 varchar(1000) DEFAULT NULL,
    post_logout_redirect_uris     varchar(1000) DEFAULT NULL,
    scopes                        varchar(1000) NOT NULL,
    client_settings               varchar(2000) NOT NULL,
    token_settings                varchar(2000) NOT NULL,
    PRIMARY KEY (id)
);

spring:
  sql:
    init:
      mode: always
      schema-locations:
        - classpath:org/springframework/security/oauth2/server/authorization/oauth2-registered-client-schema.sql
        - classpath:org/springframework/security/oauth2/server/authorization/oauth2-authorization-schema.sql
        - classpath:org/springframework/security/oauth2/server/authorization/oauth2-authorization-consent-schema.sql
        - classpath:org/springframework/security/core/userdetails/jdbc/users.ddl
  datasource:
    url: jdbc:postgresql://localhost:5432/auth
    username: auth
    password: auth

@Controller
public class LoginController {

    @GetMapping("/login")
    public String login() {
        return "login";   // src/main/resources/templates/login.html
    }
}

# 1. generate a PKCE pair
CODE_VERIFIER=$(openssl rand -base64 60 | tr -d '\n=+/' | cut -c1-64)
CODE_CHALLENGE=$(printf '%s' "$CODE_VERIFIER" | openssl dgst -binary -sha256 | openssl base64 | tr '+/' '-_' | tr -d '=')

# 2. open the authorization URL in a browser; log in and consent
open "https://auth.example.com/oauth2/authorize?response_type=code&client_id=spa\
&redirect_uri=https://spa.example.com/callback&scope=openid+profile\
&code_challenge=${CODE_CHALLENGE}&code_challenge_method=S256"

# 3. exchange the returned ?code=... for tokens
curl -s https://auth.example.com/oauth2/token \
  -d grant_type=authorization_code \
  -d client_id=spa \
  -d redirect_uri=https://spa.example.com/callback \
  -d code_verifier="${CODE_VERIFIER}" \
  -d code="AUTH_CODE_FROM_STEP_2"

# 4. inspect the server's keys and discovery document
curl -s https://auth.example.com/oauth2/jwks
curl -s https://auth.example.com/.well-known/openid-configuration

@Bean
SecurityFilterChain socialLogin(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/", "/login", "/api/auth/providers").permitAll()
            .anyRequest().authenticated())
        .oauth2Login(oauth2 -> oauth2
            .userInfoEndpoint(userInfo -> userInfo.oidcUserService(oidcUserService())))
        .logout(logout -> logout.logoutSuccessUrl("/"));
    return http.build();
}

CREATE TABLE app_user (
    id           bigserial PRIMARY KEY,
    email        varchar(320) UNIQUE,
    display_name varchar(200),
    enabled      boolean NOT NULL DEFAULT true
);

CREATE TABLE user_identity (
    id               bigserial PRIMARY KEY,
    provider         varchar(50)  NOT NULL,          -- 'google' | 'entra' | 'apple' | 'local'
    provider_user_id varchar(255) NOT NULL,          -- the 'sub' claim
    user_id          bigint       NOT NULL REFERENCES app_user (id),
    linked_at        timestamp    NOT NULL DEFAULT CURRENT_TIMESTAMP,
    UNIQUE (provider, provider_user_id)
);

@Entity
@Table(name = "app_user")
public class AppUser {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    @Column(unique = true)
    private String email;
    private String displayName;
    private boolean enabled = true;
    @ElementCollection(fetch = FetchType.EAGER)
    @CollectionTable(name = "app_user_authority", joinColumns = @JoinColumn(name = "user_id"))
    @Column(name = "authority")
    private Set<String> authorities = new HashSet<>();
    // getters / setters
}

@Entity
@Table(name = "user_identity",
       uniqueConstraints = @UniqueConstraint(columnNames = {"provider", "provider_user_id"}))
public class UserIdentity {
    @Id @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String provider;
    private String providerUserId;
    @ManyToOne(optional = false)
    @JoinColumn(name = "user_id")
    private AppUser user;
    private Instant linkedAt = Instant.now();
    // getters / setters
}

public interface AppUserRepository extends JpaRepository<AppUser, Long> {
    Optional<AppUser> findByEmail(String email);
}

public interface UserIdentityRepository extends JpaRepository<UserIdentity, Long> {
    Optional<UserIdentity> findByProviderAndProviderUserId(String provider, String providerUserId);
}

@RestController
@RequestMapping("/api")
public class AccountController {

    // InMemoryClientRegistrationRepository implements Iterable<ClientRegistration>; it is what Boot
    // creates when registrations come from spring.security.oauth2.client.registration.* properties.
    // The ClientRegistrationRepository interface itself is not iterable -- inject the concrete type
    // here, or keep your own List<ProviderInfo> if you use a different repository implementation.
    private final InMemoryClientRegistrationRepository clientRegistrations;
    private final AppUserRepository users;

    public AccountController(InMemoryClientRegistrationRepository clientRegistrations, AppUserRepository users) {
        this.clientRegistrations = clientRegistrations;
        this.users = users;
    }

    // login UI reads this to render the provider buttons
    @GetMapping("/auth/providers")
    public List<ProviderInfo> providers() {
        List<ProviderInfo> list = new ArrayList<>();
        clientRegistrations.forEach(reg -> list.add(
                new ProviderInfo(reg.getRegistrationId(), reg.getClientName(),
                        "/oauth2/authorization/" + reg.getRegistrationId())));
        return list;
    }

    @GetMapping("/me")
    public MeResponse me(@AuthenticationPrincipal OidcUser principal) {
        AppUser user = users.findByEmail(principal.getEmail()).orElseThrow();
        return new MeResponse(user.getId(), user.getEmail(), user.getDisplayName(), user.getAuthorities());
    }
}

@Bean
OAuth2AuthorizedClientManager authorizedClientManager(
        ClientRegistrationRepository clientRegistrations,
        OAuth2AuthorizedClientRepository authorizedClients) {
    OAuth2AuthorizedClientProvider provider = OAuth2AuthorizedClientProviderBuilder.builder()
            .authorizationCode()
            .refreshToken()
            .clientCredentials()
            .build();
    DefaultOAuth2AuthorizedClientManager manager =
            new DefaultOAuth2AuthorizedClientManager(clientRegistrations, authorizedClients);
    manager.setAuthorizedClientProvider(provider);
    return manager;
}

// blocking: RestClient + OAuth2ClientHttpRequestInterceptor (Spring Security 7)
@Bean
RestClient googleRestClient(OAuth2AuthorizedClientManager manager) {
    OAuth2ClientHttpRequestInterceptor interceptor = new OAuth2ClientHttpRequestInterceptor(manager);
    interceptor.setClientRegistrationIdResolver(request -> "google");
    return RestClient.builder()
            .baseUrl("https://www.googleapis.com")
            .requestInterceptor(interceptor)
            .build();
}

// reactive: WebClient + ServerOAuth2AuthorizedClientExchangeFilterFunction
@Bean
WebClient googleWebClient(ReactiveClientRegistrationRepository clientRegistrations,
                          ServerOAuth2AuthorizedClientRepository authorizedClients) {
    ServerOAuth2AuthorizedClientExchangeFilterFunction oauth2 =
            new ServerOAuth2AuthorizedClientExchangeFilterFunction(clientRegistrations, authorizedClients);
    oauth2.setDefaultClientRegistrationId("google");
    return WebClient.builder()
            .baseUrl("https://www.googleapis.com")
            .filter(oauth2)
            .build();
}