Understanding Third-Party Login Basics with the JustAuth Component

Third‑party login vs SSO

Third‑party login uses an external service (e.g., WeChat, Google, Facebook) to authenticate a user for an application. SSO (Single Sign‑On) allows a user who has logged in once to access multiple applications within the same organization without re‑entering credentials. The two differ in scope (cross‑company vs intra‑company), purpose (user acquisition vs efficiency and security), and typical protocols (OAuth for third‑party login, Kerberos/SAML/OpenID Connect for SSO).

Key technical concepts

OAuth – open standard for delegated authorization.

OpenID Connect – authentication layer built on OAuth 2.0.

Third‑party platform – external services such as WeChat, QQ, Google, Facebook, etc.

App ID & Secret – credentials issued by the platform.

Authorization Code – temporary code exchanged for an access token.

Access Token – token used to call the platform’s APIs.

Refresh Token – token to obtain a new access token when the original expires.

Redirect URI – URL to which the platform sends the user after authorization.

Scope – permissions requested from the user.

User Info – basic profile data (nickname, avatar, email) retrieved after authentication.

Implementation flow

Register the application on the third‑party platform to obtain App ID and Secret.

Provide a login button that redirects the user to the platform’s authorization page.

User logs in on the platform and grants permission; the platform redirects back with an authorization code.

Exchange the authorization code for an access token using the App ID and Secret.

Use the access token to fetch user information and complete the login/registration process in the local system.

Worked example – WeChat login for “Knowledge Planet”

The interaction involves three participants: the user, Knowledge Planet (the target service), and WeChat (the third‑party provider). The sequence proceeds as follows:

---
title: 第三方登录时序图
config:
  theme: forest
---
sequenceDiagram
autonumber
actor 用户
participant 知识星球
participant 微信
用户 ->> 知识星球: 我准备登录知识星球了
知识星球 -->> 用户: 我不认识你
用户 ->> 微信: 稍等，我找下我的大哥（微信），帮我介绍下，把我的授权码code给知识星球吧
微信 ->> 知识星球: 刚才有人想让我给你介绍一下，先给你个授权码code
知识星球 -->> 微信: 我收到了，这个授权码我担心是不是真的，真的，就把他的accessToken给我吧
微信 ->> 知识星球: 嗯，我给你下他的访问令牌，你要知道他是谁，你就拿着这个找我就行
知识星球 -->> 微信: 好的，那我就先给你下令牌，我要他用户的基本信息
微信 ->> 知识星球: OK，令牌是对的，我把他的基本信息给你了，你自己玩吧
知识星球 ->> 知识星球: 我看到了，我准备把他信息存起来，在给他个我的联系方式
知识星球 ->> 用户: 看了你的基本信息，我知道了，我允许你登录了，来吧
用户 -->> 知识星球: 十分感谢，我登录成功了，太感谢我的大哥微信了。

JustAuth library

JustAuth is an open‑source Java library that abstracts the OAuth flow for dozens of providers (GitHub, Gitee, WeChat, Google, Facebook, etc.). It follows the Strategy and Template Method patterns, making it easy to extend. The project has over 16.5K stars on GitHub: https://github.com/justauth/JustAuth.

Typical integration steps in a Spring Boot project:

Add the JustAuth starter dependency.

Configure the redirect URL (the callback endpoint).

Implement a controller method that receives the callback, lets JustAuth build the authorization URL, exchange the code for an access token, and retrieve user info.

Two common post‑login handling patterns observed in practice:

Automatic user registration on first login.

Require the user to be pre‑registered; if not found, deny login.

Reference links

JustAuth quick‑start guide: https://www.justauth.cn/guide/quickstart/how-to-use/