How to ensure make my custom OidcUserService called over the default?

Question

tl;dr: why isn't my OidcUserService despite being registered?

---

I am trying to use my own OAuth2UserService by registering it as documented in the Spring Security documentation.

However, when I put a breakpoint on the OidcUserService.loadUser(OidcUserRequest)](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/oauth2/client/oidc/userinfo/OidcUserService.html#loadUser-org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest-) method, it keeps hitting the com.okta.spring.boot.oauth.OktaOidcUserService instead! I am using com.okta.spring:okta-spring-boot-parent:1.2.2-SNAPSHOT which may be the problem?

I register my OidcUserService like documented:

@SpringBootApplication
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class RedirectCodeFlowApplication {

    public static void main(String[] args) {
        SpringApplication.run(RedirectCodeFlowApplication.class, args);
    }

    @Configuration
    static class WebConfig extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            final OidcUserService delegate = new OidcUserService();

            http.authorizeRequests().anyRequest().authenticated()
                .and()
                .oauth2Login()
                .userInfoEndpoint()
                .oidcUserService( (userRequest) -> {
                        System.out.println( "!!xXx!! never gets here" );

                        OidcUser oidcUser = delegate.loadUser(userRequest);

                        OAuth2AccessToken accessToken = userRequest.getAccessToken();
                        Set<GrantedAuthority> mappedAuthorities = new HashSet<>();

                        oidcUser = new DefaultOidcUser(mappedAuthorities, oidcUser.getIdToken(), oidcUser.getUserInfo());

                        return oidcUser;
                    })
            ;
        }

and the method I'm calling is simple:

@RestController
public class WelcomeController {

    @GetMapping("/")
    public Welcome getMessageOfTheDay(Principal principal) {
        return "The message of the day is boring.";
    }
}

This is all adapted from: https://github.com/okta/okta-spring-boot/blob/master/examples/redirect-code-flow/src/main/java/com/okta/spring/example/RedirectCodeFlowApplication.java

Rustic

Answer 1

This is a known issue: https://github.com/okta/okta-spring-boot/issues/136 (and still open as: https://github.com/okta/okta-spring-boot/issues/160 )

This was a work around used to deal with how HttpSecurity and HttpConfigurer are loaded.

I'm not 100% sure we can work around this, but, it would be easy to expose a way to add custom GrantedAuthority.

I'm going to look into the former again, but as a last resort can you confirm you are trying to set custom GrantedAuthority?

Drud

I am trying to set a custom GrantedAuthority but I couldn't figure out how to add more roles in Okta, so I am trying to convert attributes into GrantedAuthorities. I need to sdd about 16 GrantedAuthorities per user on average. – Rustic

Cool, that helps! FYI, you can convert an claim to a GrantedAuthority: github.com/okta/okta-spring-boot#configure-your-properties (groups claim by default) – Drud

Have you been able to solve your problem? I am in the same situation. – Wringer

Answer 2

Simple solution would be defining your custom service as a bean with the name 'oidcUserService'.

  @Bean(name = "oidcUserService")
  OAuth2UserService<OidcUserRequest, OidcUser> getOidcUserService() {
    return new CustomOidcUserService();
  }

With this http configuration can be simple as below:

http.authorizeRequests().anyRequest().authenticated()
                .and()
                .oauth2Login();

Apheliotropic

The oidcUserService isn't getting called. I am unable to use the access_token and spring ends up trying to decode the id_token. I want to make Spring pick up the access token. – Gurl