Expected Behavior

One time token login has a dedicated field and button on the default login page (DefaultLoginPageGeneratingFilter). Given the following configuration:

http.authorizeHttpRequests(...)
    .oneTimeTokenLogin(...)
    .build();

The default login page should be displayed, with the one time token login form.

Current Behavior

Currently, OTT alone does not enable the default login page UI. There MUST be one of formLogin, oauth2Login or saml2Login configured for the login page to be active. This is true for both Servlet and Reactive.


Planning to submit a PR for this.

Comment From: jzheaux

Closing in favor of https://github.com/spring-projects/spring-security/pull/16480