Spring Boot 接入 GitHub 第三方登录，只要两行配置！

Map<String, Object> attributes = new HashMap<>();

attributes.put(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId());

OAuth2AuthorizationRequest.Builder builder;

// 根据不同的AuthorizationGrantType构造不同的builder

if (AuthorizationGrantType.AUTHORIZATION_CODE.equals(clientRegistration.getAuthorizationGrantType())) {

builder = OAuth2AuthorizationRequest.authorizationCode();

Map<String, Object> additionalParameters = new HashMap<>();

if (!CollectionUtils.isEmpty(clientRegistration.getScopes()) &&

clientRegistration.getScopes().contains(OidcScopes.OPENID)) {

// Section 3.1.2.1 Authentication Request - https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest

// scope

//   REQUIRED. OpenID Connect requests MUST contain the “openid” scope value.

addNonceParameters(attributes, additionalParameters);

}

if (ClientAuthenticationMethod.NONE.equals(clientRegistration.getClientAuthenticationMethod())) {

addPkceParameters(attributes, additionalParameters);

}

builder.additionalParameters(additionalParameters);

} else if (AuthorizationGrantType.IMPLICIT.equals(clientRegistration.getAuthorizationGrantType())) {

builder = OAuth2AuthorizationRequest.implicit();

} else {

throw new IllegalArgumentException(“Invalid Authorization Grant Type (”  +

clientRegistration.getAuthorizationGrantType().getValue() +

") for Client Registration with Id: " + clientRegistration.getRegistrationId());

}

String redirectUriStr = expandRedirectUri(request, clientRegistration, redirectUriAction);

OAuth2AuthorizationRequest authorizationRequest = builder

.clientId(clientRegistration.getClientId())

.authorizationUri(clientRegistration.getProviderDetails().getAuthorizationUri())

.redirectUri(redirectUriStr)

.scopes(clientRegistration.getScopes())

// 生成随机state值

.state(this.stateGenerator.generateKey())

.attributes(attributes)

.build();

return authorizationRequest;

}

DefaultOAuth2AuthorizationRequestResolver判断请求是否是授权请求，最终返回一个OAuth2AuthorizationRequest对象给OAuth2AuthorizationRequestRedirectFilter，如果OAuth2AuthorizationRequest不为null的话，说明当前请求是一个授权请求，那么接下来就要拿着这个请求重定向到授权服务器的授权端点了，下面我们接着看OAuth2AuthorizationRequestRedirectFilter发送重定向的逻辑

private void sendRedirectForAuthorization(HttpServletRequest request, HttpServletResponse response,

OAuth2AuthorizationRequest authorizationRequest) throws IOException {

if (AuthorizationGrantType.AUTHORIZATION_CODE.equals(authorizationRequest.getGrantType())) {

this.authorizationRequestRepository.saveAuthorizationRequest(authorizationRequest, request, response);

}

this.authorizationRedirectStrategy.sendRedirect(request, response, authorizationRequest.getAuthorizationRequestUri());

}

1. 如果当前是授权码类型的授权请求那么就需要将这个请求信息保存下来，因为接下来授权服务器回调我们需要用到这个授权请求的参数进行校验等操作（比对state），这里是通过authorizationRequestRepository保存授权请求的，默认的保存方式是通过HttpSessionOAuth2AuthorizationRequestRep