To add OAuth2 login to a Spring Security application, include the OAuth2 Client support, configure at least one client registration, and enable oauth2Login in your security filter chain. With Spring Boot, registration and provider settings can usually be supplied as properties. Spring Security then provides the default login-start and callback paths.
What you need for OAuth2 login
OAuth2 Login is a feature of Spring Security’s OAuth2 Client support, not the resource-server feature used to validate bearer tokens sent to an API. Add the OAuth2 Client starter to a Spring Boot application:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>A login-enabled application also needs at least one ClientRegistration and a ClientRegistrationRepository. Spring Boot can build the repository from configuration properties; if you define the registration yourself, provide the repository as a bean. See the Spring Security OAuth2 login reference for the framework’s core setup.
Register an identity provider
First create an OAuth client in the provider’s developer console. Copy its client ID and secret into application configuration, and register the application’s callback URL with the provider. For the default callback, replace my-oidc-client below with the registration ID you choose.
#1 Best Overall
https://your-application.example.com/login/oauth2/code/my-oidc-clientFor local development, use the corresponding local application origin and path, such as http://localhost:8080/login/oauth2/code/my-oidc-client. The registered URL must match the redirect URI used by the application, including scheme, host, path, and registration ID.
Spring Boot properties with provider discovery
When the provider publishes OpenID Connect or authorization-server metadata, configure its issuer URI. Spring Security can use the metadata to discover the endpoints.
spring:
security:
oauth2:
client:
registration:
my-oidc-client:
provider: my-oidc-provider
client-id: my-client-id
client-secret: my-client-secret
authorization-grant-type: authorization_code
scope: openid,profile
provider:
my-oidc-provider:
issuer-uri: https://my-oidc-provider.comReplace the example issuer and credentials with values issued for your application by the identity provider. Keep client secrets out of source control; supply them through your deployment’s secret-management mechanism.
Built-in provider defaults
Spring Security includes common provider configuration for Google, GitHub, Facebook, X, and Okta. A registration ID matching a built-in provider name, such as google, can use the default provider settings with a client ID and secret. If you prefer another registration ID, specify the provider explicitly, for example provider: google. The exact capabilities and callback requirements remain subject to the provider’s own application settings.
Explicit endpoint properties
If discovery is unavailable or does not provide the settings you need, configure provider endpoints explicitly. Relevant properties include authorization URI, token URI, JWK Set URI, user-info URI, and user-name attribute. This gives you direct control over provider-specific endpoints, but you must keep those values accurate and maintain them if the provider changes them.
Enable OAuth2 login in Spring Security
When you define a custom security filter chain, enable OAuth2 login with oauth2Login:
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http.oauth2Login(Customizer.withDefaults());
return http.build();
}
}This is the minimal configuration for enabling the feature in a custom filter chain. Your application still needs a client registration, such as the Boot properties above. Add authorization rules for your application’s pages and resources as appropriate; this snippet does not define which application URLs should be public or protected.
Understand the login and callback paths
With the default endpoint configuration, use the registration ID as the final path segment:
Recommended Free Tools
/oauth2/authorization/{registrationId}starts the login flow./login/oauth2/code/{registrationId}is the callback that receives the provider’s authorization response.
For the sample registration, opening /oauth2/authorization/my-oidc-client starts login. Spring Security redirects the browser to the provider’s authorization endpoint. After the user authenticates and approves the request, the provider returns the browser to /login/oauth2/code/my-oidc-client with an authorization code. Spring Security uses that code to obtain tokens and complete authentication. The default authorization-request redirect is handled by Spring Security’s OAuth2 client flow.
Rank #4
The callback is not a page users ordinarily visit directly. It is an endpoint Spring Security processes as part of the authorization-code exchange. If you see a redirect to /login/oauth2/code/..., that is the expected default callback path, not necessarily an error.
Choose OIDC or OAuth2 user-info processing
The openid scope determines which identity-processing path applies. With openid, Spring Security uses OpenID Connect processing, including OIDC-specific components such as OidcUserService. Without that scope, it uses OAuth2 user-service processing, such as DefaultOAuth2UserService, to obtain user attributes. Include scopes that the provider supports and your application needs; do not assume every provider returns the same profile attributes.
Default endpoints versus custom paths
The default paths are convenient because Spring Security’s standard configuration and callback convention align. If your application needs different endpoint base URIs, configure the login initiation and callback paths deliberately. The client registration’s redirectUri must match the customized callback URI, and the identity provider must have that same callback registered. Changing only one side can cause the provider to reject the redirect or prevent Spring Security from matching the callback to the registration.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBest Value
Boot properties or explicit beans?
For a conventional application, Boot properties are the quickest way to define client registrations and provider details. Explicit beans are useful when registrations need to be assembled programmatically or when you require tighter control over the ClientRegistrationRepository. In either approach, OAuth2 login requires a registration repository and a security filter chain configured for login.
Test the configuration
-
Start the application with the OAuth2 Client dependency and valid registration properties or beans.
-
Open
/oauth2/authorization/my-oidc-client, substituting the registration ID in your configuration. The browser should be sent to the provider. -
Complete authentication at the provider. Confirm that it returns to the exact callback URL registered for the application.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Check that Spring Security processes the callback and returns the browser to the application. If it fails, verify the registration ID in both paths, the redirect URI, credentials, provider metadata or explicit endpoint values, and requested scopes.
For details on the authorization-code redirect mechanics, consult the Spring Security authorization-grants reference.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
