<\/p>\n
Updated August 2026 \u2014 OAuth 2 tutorial restored for this URL.<\/em><\/p>\n In this tutorial we will see how to allow login to our application using OAuth 2.0<\/strong> \/ OpenID Connect (for example Google), on top of Spring Security.<\/p>\n Previously we covered:<\/p>\n Related: JPA Auditing with MySQL<\/a> (often enabled in the same secured apps).<\/p>\n We will cover:<\/p>\n 1. What OAuth 2 login gives you<\/strong><\/p>\n Instead of only a local username\/password form, users can sign in with an external Identity Provider (IdP). Spring Security\u2019s OAuth2 Login support handles the redirect, authorization code exchange, and builds an authenticated 2. Dependencies<\/strong><\/p>\n In 3. Register an OAuth app (Google example)<\/strong><\/p>\n Copy the Client ID<\/strong> and Client secret<\/strong>.<\/p>\n 4. application.properties<\/strong><\/p>\n For GitHub, use 5. SecurityFilterChain configuration<\/strong><\/p>\n Visiting a protected URL redirects unauthenticated users to your login page (or directly to the provider if you omit a custom login page).<\/p>\n 6. Login page link<\/strong><\/p>\n The path 7. Read the logged-in OAuth user<\/strong><\/p>\n Attribute names depend on the provider (Google uses 8. Combine with form login (optional)<\/strong><\/p>\n You can keep MySQL form login from Part 2 and<\/em> OAuth:<\/p>\n On the same login page, show both the username\/password form and the \u201cContinue with Google\u201d link.<\/p>\n For production:<\/p>\n Troubleshooting<\/strong><\/p>\n Next steps<\/strong><\/p>\n Updated August 2026 \u2014 OAuth 2 tutorial restored for this URL. In this tutorial we will see how to allow login to our application using … <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[85],"tags":[],"class_list":["post-2290","post","type-post","status-publish","format-standard","hentry","category-java"],"acf":[],"_links":{"self":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/2290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/comments?post=2290"}],"version-history":[{"count":2,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/2290\/revisions"}],"predecessor-version":[{"id":2438,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/posts\/2290\/revisions\/2438"}],"wp:attachment":[{"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/media?parent=2290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/categories?post=2290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kindsonthegenius.com\/blog\/wp-json\/wp\/v2\/tags?post=2290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\n
OAuth2User<\/code>.<\/p>\npom.xml<\/code> (Spring Boot 3.x shown with Jakarta):<\/p>\n<dependency>\n <groupId>org.springframework.boot<\/groupId>\n <artifactId>spring-boot-starter-oauth2-client<\/artifactId>\n<\/dependency>\n<dependency>\n <groupId>org.springframework.boot<\/groupId>\n <artifactId>spring-boot-starter-security<\/artifactId>\n<\/dependency>\n<dependency>\n <groupId>org.springframework.boot<\/groupId>\n <artifactId>spring-boot-starter-thymeleaf<\/artifactId>\n<\/dependency>\n<\/code><\/pre>\n\n
http:\/\/localhost:8080\/login\/oauth2\/code\/google\n<\/code><\/pre>\nspring.security.oauth2.client.registration.google.client-id=YOUR_CLIENT_ID\nspring.security.oauth2.client.registration.google.client-secret=YOUR_CLIENT_SECRET\nspring.security.oauth2.client.registration.google.scope=openid,profile,email\n<\/code><\/pre>\nregistration.github<\/code> and redirect \/login\/oauth2\/code\/github<\/code>. Provider details are auto-configured for common IdPs.<\/p>\n@Configuration\n@EnableWebSecurity\npublic class SecurityConfig {\n\n @Bean\n SecurityFilterChain filterChain(HttpSecurity http) throws Exception {\n http\n .authorizeHttpRequests(auth -> auth\n .requestMatchers(\"\/\", \"\/login\", \"\/css\/**\").permitAll()\n .anyRequest().authenticated()\n )\n .oauth2Login(oauth -> oauth\n .loginPage(\"\/login\")\n )\n .logout(logout -> logout\n .logoutSuccessUrl(\"\/\")\n );\n return http.build();\n }\n}\n<\/code><\/pre>\ntemplates\/login.html<\/code>:<\/p>\n<!DOCTYPE html>\n<html xmlns:th=\"http:\/\/www.thymeleaf.org\">\n<body>\n <h1>Login<\/h1>\n <p><a th:href=\"@{\/oauth2\/authorization\/google}\">Continue with Google<\/a><\/p>\n<\/body>\n<\/html>\n<\/code><\/pre>\n\/oauth2\/authorization\/{registrationId}<\/code> starts the OAuth dance (google<\/code> matches the registration id in properties).<\/p>\n@GetMapping(\"\/me\")\n@ResponseBody\npublic Map<String, Object> me(@AuthenticationPrincipal OAuth2User user) {\n return Map.of(\n \"name\", user.getAttribute(\"name\"),\n \"email\", user.getAttribute(\"email\")\n );\n}\n<\/code><\/pre>\nemail<\/code>, name<\/code>, sub<\/code>, \u2026).<\/p>\nhttp\n .authorizeHttpRequests(...)\n .formLogin(form -> form.loginPage(\"\/login\").permitAll())\n .oauth2Login(oauth -> oauth.loginPage(\"\/login\"));\n<\/code><\/pre>\n\n
users<\/code> table<\/li>\n<\/ul>\n\n
\/login\/oauth2\/code\/google<\/code>.<\/li>\n\/login<\/code> and \/oauth2\/**<\/code> are permitted, and you are not requiring auth for the authorization endpoint.<\/li>\nemail<\/code> scope and enable the email claim in the provider console.<\/li>\n<\/ul>\n\n
createdBy<\/code> uses the OAuth email\/username.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"