Add OAuth2AuthorizationRequestResolver

[andersonkyle]

Summary

When using a 3rd party OAuth provider such as Auth0 or Okta it would be very useful to allow developers to hook into the Authorization Request URI build process in order to add custom query parameters. This is because the providers mentioned above have added additional parameters on top of the specification to allow for more functionality.

Examples

---

Auth0

audience: The unique identifier of the target API you want to access.

This parameter impacts the format of the access token

---

Okta

idp: The Identity provider used to do the authentication.

This parameter instructs Okta to either use itself as the Identity Provider or to use another identity provider connected to the Okta Authorization Server.

---

A simple hook into the building of the URI should provide sufficient flexibility for these custom parameters and any others that are introduced in the future.

[jgrandja]

@andersonkyle Makes sense. We'll aim to add this for 5.1

[jgrandja]

@andersonkyle I'm finally circling back to address this requirement.

The simplest solution to allow for custom authorization request parameters would be to allow the user to provide the request parameters via the ClientRegistration configuration.

For example, if you would like to provide the audience and idp in the Authorization Request, you would configure it as follows:

spring:
  security:
    oauth2:
      client:
        registration:
          okta:
            client-id: client-id
            client-secret: secret
	    ...
	    ...
        provider:
          okta:
            authorization-uri: https://tenant1.okta.com/oauth2/v2/auth?audience=resource1&idp=https://provider2.com
	   ...
	   ...

We would ensure that any request parameters supplied in the authorization-uri are preserved when building the Authorization Request.

Would this strategy meet your requirement?

[andersonkyle]

Yeah, that should do the trick. Thanks!

The same flexibility is needed for the token request:

{
	"grant_type":"http://auth0.com/oauth/grant-type/password-realm",
	"username": "jdoe@example.com",
	"password": "password",
	"realm": "UserDatabase5",
	"audience": "https://api.example.com",
	"scope": "openid email profile",
	"client_id": "1234",
	"client_secret": "5678"
}

^ the above example POST /oauth/token body for a Resource Owner Password Credentials grant includes 2 additional parameters: audience, realm as well as a custom value for grant_type.

This may be worthy of a separate ticket but thought I'd mention it while you're looking at this.

Both of these improvements will make working with 3rd party providers (who love to add functionality on top of the spec) much easier!