Describe the bug

While XSD defines a top-level element <provider>, there are no handlers defined for it in SecurityNamespaceHandler. And if we look at ClientRegistrationsBeanDefinitionParser - it looks for providers inside of <client-registrations>. But the latter can't have such child tags according to the XSD.

So seems like there's no way to define custom OAuth2 configuration if it's XML configuration.

Comment From: sjohnr

Hi @ctapobep, thanks for reaching out!

While XSD defines a top-level element , there are no handlers defined for it in SecurityNamespaceHandler.

I believe this line configures the <client-registrations> element:

https://github.com/spring-projects/spring-security/blob/0aac515737e385feca81286a6f0bfd1ef2bb90ab/config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java#L193

which parses the "provider" tag here:

https://github.com/spring-projects/spring-security/blob/0aac515737e385feca81286a6f0bfd1ef2bb90ab/config/src/main/java/org/springframework/security/config/oauth2/client/ClientRegistrationsBeanDefinitionParser.java#L142

You can see some examples in unit tests, such as this one:

https://github.com/spring-projects/spring-security/blob/0aac515737e385feca81286a6f0bfd1ef2bb90ab/config/src/test/resources/org/springframework/security/config/oauth2/client/google-registration.xml#L36-L42

Does that help answer your question?

Comment From: ctapobep

Oh my, I missed that it's a xs:sequence and so the order of elements matters. Sorry for this.

Comment From: sjohnr

Not a problem, @ctapobep.