Security Top

The early-bird price of the new Learn Spring Security OAuth course packages will increase by $50 tomorrow:


1. Overview

In this quick tutorial, we'll focus on setting up OpenID Connect with a Spring Security OAuth2 implementation.

OpenID Connect is a simple identity layer built on top of the OAuth 2.0 protocol.

And, more specifically, we'll learn how to authenticate users using the OpenID Connect implementation from Google.

2. Maven Configuration

First, we need to add the following dependencies to our Spring Boot application:


3. The Id Token

Before we dive into the implementation details, let's have a quick look at how OpenID works, and how we'll interact with it.

At this point, it's, of course, important to already have an understanding of OAuth2, since OpenID is built on top of OAuth.

First, in order to use the identity functionality, we'll make use of a new OAuth2 scope called openid. This will result in an extra field in our Access Token – “id_token“.

The id_token is a JWT (JSON Web Token) that contains identity information about the user, signed by identity provider (in our case Google).

Finally, both server(Authorization Code) and implicit flows are the most commonly used ways of obtaining id_token, in our example, we will use server flow.

3. OAuth2 Client Configuration

Next, let's configure our OAuth2 client – as follows:

public class GoogleOpenIdConnectConfig {
    private String clientId;

    private String clientSecret;

    private String accessTokenUri;

    private String userAuthorizationUri;

    private String redirectUri;

    public OAuth2ProtectedResourceDetails googleOpenId() {
        AuthorizationCodeResourceDetails details = new AuthorizationCodeResourceDetails();
        details.setScope(Arrays.asList("openid", "email"));
        return details;

    public OAuth2RestTemplate googleOpenIdTemplate(OAuth2ClientContext clientContext) {
        return new OAuth2RestTemplate(googleOpenId(), clientContext);

And here is

google.clientId=<your app clientId>
google.clientSecret=<your app clientSecret>

Note that:

  • You first need to obtain OAuth 2.0 credentials for your Google web app from Google Developers Console.
  • We used scope openid to obtain id_token.
  • we also used an extra scope email to include user email in id_token identity information.
  • The redirect URI http://localhost:8081/google-login is the same one used in our Google web app.

4. Custom OpenID Connect Filter

Now, we need to create our own custom OpenIdConnectFilter to extract authentication from id_token – as follows:

public class OpenIdConnectFilter extends AbstractAuthenticationProcessingFilter {

    public OpenIdConnectFilter(String defaultFilterProcessesUrl) {
        setAuthenticationManager(new NoopAuthenticationManager());
    public Authentication attemptAuthentication(
      HttpServletRequest request, HttpServletResponse response) 
      throws AuthenticationException, IOException, ServletException {
        OAuth2AccessToken accessToken;
        try {
            accessToken = restTemplate.getAccessToken();
        } catch (OAuth2Exception e) {
            throw new BadCredentialsException("Could not obtain access token", e);
        try {
            String idToken = accessToken.getAdditionalInformation().get("id_token").toString();
            String kid = JwtHelper.headers(idToken).get("kid");
            Jwt tokenDecoded = JwtHelper.decodeAndVerify(idToken, verifier(kid));
            Map<String, String> authInfo = new ObjectMapper()
              .readValue(tokenDecoded.getClaims(), Map.class);
            OpenIdConnectUserDetails user = new OpenIdConnectUserDetails(authInfo, accessToken);
            return new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
        } catch (InvalidTokenException e) {
            throw new BadCredentialsException("Could not obtain user details from token", e);

And here is our simple OpenIdConnectUserDetails:

public class OpenIdConnectUserDetails implements UserDetails {
    private String userId;
    private String username;
    private OAuth2AccessToken token;

    public OpenIdConnectUserDetails(Map<String, String> userInfo, OAuth2AccessToken token) {
        this.userId = userInfo.get("sub");
        this.username = userInfo.get("email");
        this.token = token;

Note that:

  • Spring Security JwtHelper to decode id_token.
  • id_token always contains “sub” field which is a unique identifier for the user.
  • id_token will also contain “email” field as we added email scope to our request.

4.1. Verifying the ID Token

In the example above, we used the decodeAndVerify() method of JwtHelper to extract information from the id_token, but also to validate it.

The first step for this is verifying that it was signed with one of the certificates specified in the Google Discovery document.

These change about once per day, so we'll use a utility library called jwks-rsa to read them:


Let's add the URL that contains the certificates to the file:


Now we can read this property and build the RSAVerifier object:

private String jwkUrl;    

private RsaVerifier verifier(String kid) throws Exception {
    JwkProvider provider = new UrlJwkProvider(new URL(jwkUrl));
    Jwk jwk = provider.get(kid);
    return new RsaVerifier((RSAPublicKey) jwk.getPublicKey());

Finally, we'll also verify the claims in the decoded id token:

public void verifyClaims(Map claims) {
    int exp = (int) claims.get("exp");
    Date expireDate = new Date(exp * 1000L);
    Date now = new Date();
    if (expireDate.before(now) || !claims.get("iss").equals(issuer) || 
      !claims.get("aud").equals(clientId)) {
        throw new RuntimeException("Invalid claims");

The verifyClaims() method is checking that the id token was issued by Google and that it's not expired.

You can find more information on this in the Google documentation.

5. Security Configuration

Next, let's discuss our security configuration:

public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private OAuth2RestTemplate restTemplate;

    public OpenIdConnectFilter openIdConnectFilter() {
        OpenIdConnectFilter filter = new OpenIdConnectFilter("/google-login");
        return filter;

    protected void configure(HttpSecurity http) throws Exception {
        .addFilterAfter(new OAuth2ClientContextFilter(), 
        .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/google-login"))

Note that:

  • We added our custom OpenIdConnectFilter after OAuth2ClientContextFilter
  • We used a simple security configuration to redirect users to “/google-login” to get authenticated by Google

6. User Controller

Next, here is a simple controller to test our app:

public class HomeController {
    public String home() {
        String username = SecurityContextHolder.getContext().getAuthentication().getName();
        return "Welcome, " + username;

Sample response (after redirect to Google to approve app authorities) :

Welcome, [email protected]

7. Sample OpenID Connect Process

Finally, let's take a look at a sample OpenID Connect authentication process.

First, we're going to send an Authentication Request:

The response (after user approval) is a redirect to:


Next, we're going to exchange the code for an Access Token and id_token:

    client_id= sampleClientID&
    client_secret= sampleClientSecret&

Here's a sample Response:

    "access_token": "SampleAccessToken",
    "id_token": "SampleIdToken",
    "token_type": "bearer",
    "expires_in": 3600,
    "refresh_token": "SampleRefreshToken"

Finally, here's what the information of the actual id_token looks like:

    "email":"[email protected]",

So you can immediately see just how useful the user information inside the token is for providing identity information to our own application.

8. Conclusion

In this quick intro tutorial, we learned how to authenticate users using the OpenID Connect implementation from Google.

And, as always, you can find the source code over on GitHub.

Security bottom

The early-bird price of the new Learn Spring Security OAuth course packages will increase by $50 tomorrow:

newest oldest most voted
Notify of

I tried your code. it can do only one step of authentication, and cannot convert the access token to user info.

Eugen Paraschiv

Hey Kodbani,
That’s interesting – but unfortunately it’s not easy to reproduce. Feel free to open an issue over on Github with a bit more info to be able to reproduce this one.

Gil9091 Gutti (Gaara)
Gil9091 Gutti (Gaara)

As could be the login with Office365. Is that I try to do it following this example but when I log in gives me this error

error=”access_denied”, error_description=”Access token denied.”

Caused by: error=”invalid_request”, error_description=”AADSTS90014: The request body must contain the following parameter: ‘client_id’.
Trace ID: cdb3fd35-5963-4cf4-8815-331dd1df0e00
Correlation ID: bc0dc582-95d1-404e-a7f0-4d7f6d0d7190

Eugen Paraschiv

Hey Gaara – that’s an interesting question, and also quite a code-heavy one – so the comments here are probably not the best place for it.
My suggestion is – do a quick writeup of it on StackOverflow and send me the link (either here or via email) – and I’d be happy to have a look. Cheers,

Gil9091 Gutti (Gaara)
Gil9091 Gutti (Gaara)
Chris Hunter
Chris Hunter

I’m reading this to create a working Google Authentication, so that I can understand the flow, but these code appears to be missing the OpenIdConnectFilter constructor.

Do you have somewhere to point me to so that I can get a running instance?

Grzegorz Piwowarek
Grzegorz Piwowarek
Chris Hunter
Chris Hunter

Thank you.

Comments are closed on this article!