spring-bootspring-securityoauth-2.0huawei-developershuawei-account

Huawei OAuth 2.0 with Spring Security causes "missing required parameter: client_id"


I have the following Spring Security configuration:

spring:
  security:
    oauth2:
      client:
        registration:
          huawei:
            client_id: blablabla
            client-secret: blablabla
            redirect-uri: 'http://localhost:8080/login/oauth2/code/huawei'
            scope: openid
        huawei:
          authorization-uri: https://oauth-login.cloud.huawei.com/oauth2/v3/authorize
          token-uri: https://oauth-login.cloud.huawei.com/oauth2/v3/token
          user-info-uri: https://oauth-login.cloud.huawei.com/oauth2/v3/userinfo
          user-name-attribute: login

Same configurations works well with a big number of different OAuth Providers, and I see that Spring sends proper request to Huawei OAuth Provider:

20:27:23.497 [parallel-5] DEBUG o.s.s.w.s.DefaultServerRedirectStrategy - Redirecting to 'https://oauth-login.cloud.huawei.com/oauth2/v3/authorize?response_type=code&client_id=<MY ID HERE>&scope=openid&state=<...>&redirect_uri=http://localhost:8080/login/oauth2/code/huawei&nonce=<...>' 

But Spring receives an erroneous response:

[{sub_error=20001, error_description=missing required parameter: client_id, error=1102}]

Short answer is here for a custom OAuth client and is related to the thing that clientId is expected in x-www-form-urlencoded, but the question still remains: how to change my Spring Security configuration to make it work?


Solution

  • Spring Security configuration has property user-info-authentication-method on provider level. It configures a way of passing clientId and clientSecret to OAuth2 Server. user-info-authentication-method has the following values:

    So you need to use form for Huawei OAuth2