How to get oauth2 code param to redirect after login in the oauth2 auth code flow

My app has custom login endpoint and the spring-auth-server redirects user agent to /login

Redirect to login After the following call

curl --location 'http://localhost:8082/oauth2/authorize?response_type=code&client_id=oauth-dev&client_secret=secret&redirect_uri=https%3A%2F%2Fexample.com&state=state123'

The current issue is my login endpoint can redirect to the redirect_uri: https://example.com, but I don't find how to get the oauth2 code param so it becomes


"redirect:" + savedRequest.getParameterValues("redirect_uri") + "&code=" + code + "&state" = state;


login endpoint

    @PostMapping("/login")
    public String login(final HttpServletRequest request, String username) {
// the auth service mainly authenticates user by username/password
        authService.authenticate(username);

        SavedRequest savedRequest: =  request.session.getAttribute("SPRING_SECURITY_SAVED_REQUEST") as SavedRequest;
        return "redirect:" + savedRequest.getParameterValues("redirect_uri");
// it's missing code param. how to find the oauth2 code param?
    }

SecurityConfig

    @Autowired
    private lateinit var passwordEncoder: PasswordEncoder

    @Bean
    @Order(1)
    fun authorizationServerSecurityFilterChain(http: HttpSecurity): SecurityFilterChain {
        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http)
        http.getConfigurer(OAuth2AuthorizationServerConfigurer::class.java)
            .oidc(Customizer.withDefaults())

        http
            .exceptionHandling { exceptions ->
                exceptions.authenticationEntryPoint(LoginUrlAuthenticationEntryPoint ("/login"))
            }
            .oauth2ResourceServer {
                it.jwt()
            }
        return http.build()
    }

    @Bean
    fun authorizationServerSettings(): AuthorizationServerSettings {
        return AuthorizationServerSettings.builder().build()
    }

    @Bean
    fun authorizationService(): OAuth2AuthorizationService {
        return InMemoryOAuth2AuthorizationService()
    }

    @Bean
    fun registeredClientRepository(): RegisteredClientRepository {
        val registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
            .clientId("oauth-dev")
            .clientSecret(passwordEncoder.encode("secret"))
            .authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
            .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
            .redirectUri("https://example.com")
            .clientSettings(ClientSettings.builder()
                .requireAuthorizationConsent(false)
                .requireProofKey(false).build())
            .build()

        return InMemoryRegisteredClientRepository(registeredClient)
    }

    @Bean
    fun jwkSource(): JWKSource<SecurityContext> {
        val rsaKey = Jwks.generateRsa()
        val jwkSet = JWKSet(rsaKey)
        return JWKSource { jwkSelector: JWKSelector, securityContext: SecurityContext? -> jwkSelector.select(jwkSet) }
    }

    @Bean
    fun jwtDecoder(jwkSource: JWKSource<SecurityContext>): JwtDecoder {
        return OAuth2AuthorizationServerConfiguration.jwtDecoder(jwkSource)
    }

Specifically, I faced the issue at step 9 as shown in the following diagram. How can the login service at step 9 find the oauth2 code param?

I saw the code generation part is not reached

https://github.com/spring-projects/spring-authorization-server/blob/main/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java#L194

because of this condition

if (!isPrincipalAuthenticated(principal)) {

https://github.com/spring-projects/spring-authorization-server/blob/main/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/authentication/OAuth2AuthorizationCodeRequestAuthenticationProvider.java#L149

and the principal is AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[ROLE_ANONYMOUS]]

Your question asks "How to get state and code for redirect after login in auth code flow" but does not mention how the user is actually authenticated, or whether the Authorization Endpoint has been successfully invoked. Your login endpoint does not appear to authenticate the user, so I'm unclear on how it's supposed to work.

> I can see OAuth2AuthorizationCodeRequestAuthenticationToken has a attribute authorizationCode, but it's null

Based on your described issue, it sounds like you have not actually invoked the /oauth2/authorize endpoint and generated an authorization_code yet, and so that's the next step.

The saved request you are retrieving after authenticating the user is actually the request to the /oauth2/authorize endpoint. You will not yet have the code and state parameters, as those are created/managed by the Authorization Endpoint. So you have only to redirect to the savedRequest.getRedirectUrl() from the SavedRequest and you should be good to go.

You can (and probably should) use HttpSessionRequestCache instead of directly accessing the session, like this:

private RequestCache requestCache = new HttpSessionRequestCache();

// ...

SavedRequest savedRequest = this.requestCache.getRequest(request, response);
String redirectUrl = savedRequest.getRedirectUrl();

Note: It's not clear from your question what about the redirectUrl is not working, but it seems that you're expecting the wrong thing here.

If that doesn't quite clear it up, please add more details of what you're login endpoint is doing and what isn't working when you redirect to the redirectUrl from the SavedRequest.

I found the solution. Below is what I learnd:

Manually invoking the security filter chain within a controller is not recommended because it can bypass the normal Spring Security flow, potentially leading to security vulnerabilities.

In general, it is also not recommended to invoke AuthenticationManager manually within a controller. The AuthenticationManager is typically invoked by the security filter chain during the authentication process, and manually invoking it may result in unexpected behavior or security vulnerabilities

Thus, the custom endpoint for login is re-written using .formLogin() and a custom successHandler and a custom failureHandler

@Component
class LoginSuccessHandler() : SavedRequestAwareAuthenticationSuccessHandler() {

    private var requestCache: RequestCache = HttpSessionRequestCache()

    override fun onAuthenticationSuccess(
        request: HttpServletRequest,
        response: HttpServletResponse,
        authentication: Authentication
    ) {
        val savedRequest = this.requestCache.getRequest(request, response)

        // login is not from auth code flow
        if (savedRequest == null) {
          // custom logic
          return
        }

        // auth code flow
        val targetUrl = savedRequest.redirectUrl
        redirectStrategy.sendRedirect(request, response, targetUrl)
    }

    override fun setRequestCache(requestCache: RequestCache) {
        this.requestCache = requestCache
    }
}

@Component
class LoginFailureHandler(
) : SimpleUrlAuthenticationFailureHandler() {

    override fun onAuthenticationFailure(
        request: HttpServletRequest,
        response: HttpServletResponse,
        ex: AuthenticationException
    ) {
       // custom logic

        super.onAuthenticationFailure(request, response, ex)
    }
}