Spring-security: LoginPage for OAuth2

[adolfoweloy]

Summary

When using OAuth2 Login, how can I customize the Login Page to present all Identity Providers login button in a custom way?

Actual Behavior

I am configuring OAuth2 Login as follows:

http
     .authorizeRequests()
     .antMatchers("/callback").permitAll()
     .anyRequest().authenticated().and()
     .oauth2Login().and();

OAuth2LoginConfigurer does not expose AuthorizationCodeAuthenticationFilterConfigurer and does not provide a loginPage method to allow login page configuration.

Expected Behavior

Am I doing something wrong?
If by using OAuth2Login configurer, a login page is generated I think it would be nice to make it customizable.

Version

5.0.0.M4

[jgrandja]

@adolfoweloy Thanks for the report.

Agreed, the user should be able to configure a custom login page via http.oauth2Login().loginPage("/custom-login")

This will get in before 5.0 is released.

[MattSmiglarski]

If you can stomach it, this workaround works for me:

                        Field field = OAuth2LoginConfigurer.class.getDeclaredField("authorizationCodeAuthenticationFilterConfigurer");
                        field.setAccessible(true);
                        Object targetObject = field.get(http.oauth2Login());

                        // Ensure the security builder is set, to avoid the framework complaining.
                        ((AbstractAuthenticationFilterConfigurer) targetObject).setBuilder(http);

                        Method loginPageMethod = AbstractAuthenticationFilterConfigurer.class.getDeclaredMethod("loginPage", String.class);
                        loginPageMethod.setAccessible(true);
                        loginPageMethod.invoke(targetObject, "/");
                        log.warn("Reflection hack performed - please simplify this code when the Spring API allows for it.");

[jgrandja]

@adolfoweloy @MattSmiglarski You can now configure a custom login page for oauth2.

Example security configuration:

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/custom-login").permitAll()
                .anyRequest().authenticated()
                .and()
            .oauth2Login()
                .loginPage("/custom-login");

    }

You would also need to define your Controller that provides your custom login page:

    @RequestMapping("/custom-login")
    public String login() {
        return "login";
    }