AuthorizationRequestRepository 负责 OAuth2AuthorizationRequest 从启动 Authorization Request 到接收 Authorization Response（回调）的持续性。

	Tip
	使用 OAuth2AuthorizationRequest 来关联和验证 Authorization Response。

AuthorizationRequestRepository 的默认实现是 HttpSessionOAuth2AuthorizationRequestRepository，它在 HttpSession 中存储 OAuth2AuthorizationRequest。

如果你想提供在 Cookie 中存储 OAuth2AuthorizationRequest 属性的 AuthorizationRequestRepository 的自定义实现，请配置它，如下面的示例所示：

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Login()
				.authorizationEndpoint()
					.authorizationRequestRepository(this.cookieAuthorizationRequestRepository())
					...
	}

	private AuthorizationRequestRepository<OAuth2AuthorizationRequest> cookieAuthorizationRequestRepository() {
		return new HttpCookieOAuth2AuthorizationRequestRepository();
	}
}

OAuth2AccessTokenResponseClient 负责在授权服务器的 Token Endpoint 为访问令牌凭证交换授权授权凭证。

OAuth2AccessTokenResponseClient 的默认实现是 NimbusAuthorizationCodeTokenResponseClient，它在 Token Endpoint 交换访问令牌的授权代码。

	Note
	NimbusAuthorizationCodeTokenResponseClient 在内部使用 Nimbus OAuth 2.0 SDK。

如果你想提供使用 Spring Framework 5 的响应式 WebClient 启动 Token Endpoint 请求的 OAuth2AccessTokenResponseClient，请配置它，如下面的示例所示：

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Login()
				.tokenEndpoint()
					.accessTokenResponseClient(this.accessTokenResponseClient())
					...
	}

	private OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient() {
		return new SpringWebClientAuthorizationCodeTokenResponseClient();
	}
}

在用户成功地通过 OAuth 2.0 提供者进行认证之后，OAuth2User.getAuthorities() (或 OidcUser.getAuthorities()) 可以被映射到一组新的 GrantedAuthority 实例，在完成身份验证时，这些实例将被提供给 OAuth2AuthenticationToken。

	Tip
	OAuth2AuthenticationToken.getAuthorities() 用于授权请求，例如在 hasRole('USER') 或 hasRole('ADMIN') 中。

当映射用户权限时，有两个选项可供选择：

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Login()
				.userInfoEndpoint()
					.userAuthoritiesMapper(this.userAuthoritiesMapper())
					...
	}

	private GrantedAuthoritiesMapper userAuthoritiesMapper() {
		return (authorities) -> {
			Set<GrantedAuthority> mappedAuthorities = new HashSet<>();

			authorities.forEach(authority -> {
				if (OidcUserAuthority.class.isInstance(authority)) {
					OidcUserAuthority oidcUserAuthority = (OidcUserAuthority)authority;

					OidcIdToken idToken = oidcUserAuthority.getIdToken();
					OidcUserInfo userInfo = oidcUserAuthority.getUserInfo();

					// Map the claims found in idToken and/or userInfo
					// to one or more GrantedAuthority's and add it to mappedAuthorities

				} else if (OAuth2UserAuthority.class.isInstance(authority)) {
					OAuth2UserAuthority oauth2UserAuthority = (OAuth2UserAuthority)authority;

					Map<String, Object> userAttributes = oauth2UserAuthority.getAttributes();

					// Map the attributes found in userAttributes
					// to one or more GrantedAuthority's and add it to mappedAuthorities

				}
			});

			return mappedAuthorities;
		};
	}
}

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.oauth2Login();
	}

	@Bean
	public GrantedAuthoritiesMapper userAuthoritiesMapper() {
		...
	}
}

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Login()
				.userInfoEndpoint()
					.oidcUserService(this.oidcUserService())
					...
	}

	private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService() {
		final OidcUserService delegate = new OidcUserService();

		return (userRequest) -> {
			// Delegate to the default implementation for loading a user
			OidcUser oidcUser = delegate.loadUser(userRequest);

			OAuth2AccessToken accessToken = userRequest.getAccessToken();
			Set<GrantedAuthority> mappedAuthorities = new HashSet<>();

			// TODO
			// 1) Fetch the authority information from the protected resource using accessToken
			// 2) Map the authority information to one or more GrantedAuthority's and add it to mappedAuthorities

			// 3) Create a copy of oidcUser but use the mappedAuthorities instead
			oidcUser = new DefaultOidcUser(mappedAuthorities, oidcUser.getIdToken(), oidcUser.getUserInfo());

			return oidcUser;
		};
	}
}

CustomUserTypesOAuth2UserService 是 OAuth2UserService 的一种实现，它为自定义 OAuth2User 类型提供支持。

如果默认实现（DefaultOAuth2User）不适合你的需求，你可以定义自己的 OAuth2User 的实现。

下面的代码演示了如何为 GitHub 注册自定义 OAuth2User 类型：

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Login()
				.userInfoEndpoint()
					.customUserType(GitHubOAuth2User.class, "github")
					...
	}
}

下面的代码展示了为 GitHub 自定义 OAuth2User 类型的示例：

public class GitHubOAuth2User implements OAuth2User {
	private List<GrantedAuthority> authorities =
		AuthorityUtils.createAuthorityList("ROLE_USER");
	private Map<String, Object> attributes;
	private String id;
	private String name;
	private String login;
	private String email;

	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return this.authorities;
	}

	@Override
	public Map<String, Object> getAttributes() {
		if (this.attributes == null) {
			this.attributes = new HashMap<>();
			this.attributes.put("id", this.getId());
			this.attributes.put("name", this.getName());
			this.attributes.put("login", this.getLogin());
			this.attributes.put("email", this.getEmail());
		}
		return attributes;
	}

	public String getId() {
		return this.id;
	}

	public void setId(String id) {
		this.id = id;
	}

	@Override
	public String getName() {
		return this.name;
	}

	public void setName(String name) {
		this.name = name;
	}

	public String getLogin() {
		return this.login;
	}

	public void setLogin(String login) {
		this.login = login;
	}

	public String getEmail() {
		return this.email;
	}

	public void setEmail(String email) {
		this.email = email;
	}
}

	Tip
	id、name、login 和 email 是在 GitHub 的 UserInfo Response 中返回的属性。有关从 UserInfo Endpoint 返回的详细信息，请参阅 "获取认证用户" 的 API 文档。

DefaultOAuth2UserService 是一个支持标准 OAuth2 提供者的 OAuth2UserService 的实现。

	Note
	OAuth2UserService 从 UserInfo Endpoint（通过使用在授权流期间授予客户端的访问令牌）获得最终用户（资源所有者）的用户属性，并以 OAuth2User 的形式返回 AuthenticatedPrincipal。

如果默认实现不适合你的需要，你可以为标准的 OAuth 2.0 提供程序定义自己的 OAuth2UserService 实现。

下面的配置演示如何配置自定义的 OAuth2UserService：

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Login()
				.userInfoEndpoint()
					.userService(this.oauth2UserService())
					...
	}

	private OAuth2UserService<OAuth2UserRequest, OAuth2User> oauth2UserService() {
		return new CustomOAuth2UserService();
	}
}

OidcUserService 是支持 OpenID Connect 1.0 Provider 的 OAuth2UserService 的实现。

	Note
	OAuth2UserService 负责从 UserInfo Endpoint（通过使用在授权流期间授予客户端的访问令牌）获取最终用户（资源所有者）的用户属性，并以 OidcUser 的形式返回 AuthenticatedPrincipal。

如果默认实现不适合你的需要，那么你可以定义自己的 OpenID Connect 1.0 Provider 的 OAuth2UserService 实现。

下面的配置演示如何配置自定义 OpenID Connect 1.0 OAuth2UserService：

@EnableWebSecurity
public class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.oauth2Login()
				.userInfoEndpoint()
					.oidcUserService(this.oidcUserService())
					...
	}

	private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService() {
		return new CustomOidcUserService();
	}
}