Expected Behavior
On successful authorization, the stored authorized client includes any additional parameters provided by the auth server during the code grant flow.
Current Behavior
OAuth2AuthorizationCodeGrantFilter currently creates a OAuth2AuthorizedClient directly and then saves it via the OAuth2AuthorizedClientRepository. It doesn't provide any means to include additional parameters from the authorization step. The OAuth2AuthorizationCodeAuthenticationToken has additionalParameters already.
As an example of how it could be modified to pass the parameters:
-
Extend OAuth2AuthorizedClient to include and additionalParameters map e.g.:
private Map<String, Object> additionalParameters = new HashMap<>(); -
Modify
OAuth2AuthorizationCodeGrantFilterto copy theadditionalParametersfrom theOAuth2AuthorizationCodeAuthenticationTokento theOAuth2AuthorizedClient
Context
I'm using an API that includes a couple of extra parameters in the code grant flow and the client needs to include these parameters in headers in order to use the API. I can't currently see a way to get those parameters stored with the authorized client without re-writing the filter.