Allow deep customize for nonstandard OAuth 2.0 provider.

I’ve reported spring-security related issue in the wrong place (in spring-boot project). The link of that issue I wanted to report: https://github.com/spring-projects/spring-boot/issues/17148

I have pointed out that wechat not only the authentication URL does not follow the specification, but other aspects also not follow, however, I can customize them without javassist.

In my opinion, do not need to support the nonstandard OAuth 2.0 providers, but make the code more flexible to allow the developers can deep customize them.

The spring security version I’m using is 5.1.5.RELEASE.

[jgrandja]

@zhangyanwei No worries. We do want to ensure that our API’s provide flexibility for customizations even when the provider doesn’t comply with the related specifications. So please do let us know if you run into a situation where there isn’t an option to customize and we’ll do our best to accommodate.

[jgrandja]

@zhangyanwei

I meant to build a URL (authorizationRequestUri field in OAuth2AuthorizationRequest class) with ordered query parameters.

The documentation shows how you can build the full URL for authorizationRequestUri:

The following example shows a variation of the customAuthorizationRequest() method from the preceding example, and instead overrides the OAuth2AuthorizationRequest.authorizationRequestUri property.

private OAuth2AuthorizationRequest customAuthorizationRequest(
        OAuth2AuthorizationRequest authorizationRequest) {

    String customAuthorizationRequestUri = UriComponentsBuilder
            .fromUriString(authorizationRequest.getAuthorizationRequestUri())
            .queryParam("prompt", "consent")
            .build(true)
            .toUriString();

    return OAuth2AuthorizationRequest.from(authorizationRequest)
            .authorizationRequestUri(customAuthorizationRequestUri)
            .build();
}

The code snippet above shows this. You have full control on building the custom URL customAuthorizationRequestUri and than setting it in OAuth2AuthorizationRequest.Builder.authorizationRequestUri.