Spring Security OAuth2 Callback Authentication Explained: Managers & Providers

2. AuthenticationManager

When Spring Security intercepts the callback endpoint, it creates an OAuth2LoginAuthenticationToken and hands it to the AuthenticationManager for authentication. Our earlier article "Understanding AuthenticationManager" provides a detailed explanation of this mechanism.

The login credentials are encapsulated in a UsernamePasswordAuthenticationToken, and based on the token type, the corresponding AuthenticationProvider is located for authentication.

3. AuthenticationProvider for OAuth2

OAuth2 login works similarly; we need to locate the AuthenticationProvider that corresponds to OAuth2LoginAuthenticationToken. Two providers are found:

OAuth2LoginAuthenticationProvider

OidcAuthorizationCodeAuthenticationProvider

These providers handle different scenarios. The OAuth2LoginAuthenticationToken contains the following snippet:

if (loginAuthenticationToken.getAuthorizationExchange()
    .getAuthorizationRequest().getScopes().contains("openid")) {
    // This is an OpenID Connect Authentication Request so return null
    // and let OidcAuthorizationCodeAuthenticationProvider handle it instead
    return null;
}

This means that if the scopes contain openid, the method returns null, so the token is not processed by OAuth2LoginAuthenticationProvider; instead, OidcAuthorizationCodeAuthenticationProvider handles it. Based on previous articles, the provider we need for standard OAuth2 login is OAuth2LoginAuthenticationProvider.

If you are interested, you can learn about OIDC‑based OAuth2 authentication.

4. OAuth2LoginAuthenticationProvider

OAuth2LoginAuthenticationProvider

implements the authentication process for the authorization callback:

From the diagram, the actual authentication is performed by OAuth2AuthorizationCodeAuthenticationProvider. After successful authentication, it retrieves the user's information, wraps it into an OAuth2User, and finally creates a successful OAuth2LoginAuthenticationToken.

Due to length constraints, the next article will analyze the handling mechanism of OAuth2AuthorizationCodeAuthenticationProvider. The series can be found at felord.cn.