Spring Security 5 OAuth2程序化选择客户端方案确认及替代方案咨询

你的实现是完全正确的，通过自定义登录页控制器，根据请求执行逻辑选择目标客户端后跳转至/oauth2/authorization/{registrationId}的方式，是Spring Security OAuth2官方支持的流程之一，能够满足程序化选择客户端的需求。

如果想让实现更贴合Spring Security的架构设计，或者简化流程，可参考以下几种方案：

1. 自定义OAuth2AuthorizationRequestResolver #

这是最推荐的方案，无需自定义登录页和控制器，直接在OAuth2授权流程中拦截并动态修改目标客户端ID，逻辑更内聚。

示例代码：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeRequests(auth -> auth.anyRequest().authenticated())
        .oauth2Login(oauth2 -> oauth2
            .authorizationEndpoint(endpoint -> endpoint
                .authorizationRequestResolver(customAuthorizationRequestResolver(http))
            )
        );
    return http.build();
}

private OAuth2AuthorizationRequestResolver customAuthorizationRequestResolver(HttpSecurity http) {
    DefaultOAuth2AuthorizationRequestResolver defaultResolver = 
        new DefaultOAuth2AuthorizationRequestResolver(
            http.getSharedObject(ClientRegistrationRepository.class),
            "/oauth2/authorization"
        );
    return (request, response) -> {
        // 自定义逻辑选择目标clientRegistrationId，比如根据请求头、参数、域名等
        String targetClientId = determineTargetClientId(request);
        defaultResolver.setClientRegistrationId(targetClientId);
        return defaultResolver.resolve(request, response);
    };
}

private String determineTargetClientId(HttpServletRequest request) {
    // 示例：根据请求参数"client"选择，无参数时返回默认客户端
    return request.getParameter("client") != null ? request.getParameter("client") : "default-client";
}

2. 优化现有登录页控制器逻辑 #

如果需要保留自定义登录页（比如展示额外提示、协议说明），可以优化现有控制器的跳转逻辑，避免硬编码路径：

@GetMapping("/oauth2/custom-login-page")
public String getCustomLoginPage(HttpServletRequest request) {
    String targetClientRegistrationID = determineTargetClientId(request);
    // 使用ServletUriComponentsBuilder动态构建跳转地址，适配不同部署环境
    return "redirect:" + ServletUriComponentsBuilder.fromContextPath(request)
            .path("/oauth2/authorization/{clientId}")
            .buildAndExpand(targetClientRegistrationID)
            .toUriString();
}

3. 自定义AuthenticationEntryPoint #

如果希望用户未认证时直接触发客户端选择逻辑，无需跳转登录页，可以自定义认证入口点：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeRequests(auth -> auth.anyRequest().authenticated())
        .oauth2Login()
        .and()
        .exceptionHandling(exceptions -> exceptions
            .authenticationEntryPoint(customAuthenticationEntryPoint())
        );
    return http.build();
}

private AuthenticationEntryPoint customAuthenticationEntryPoint() {
    return (request, response, authException) -> {
        String targetClientId = determineTargetClientId(request);
        String redirectUrl = ServletUriComponentsBuilder.fromContextPath(request)
                .path("/oauth2/authorization/{clientId}")
                .buildAndExpand(targetClientId)
                .toUriString();
        response.sendRedirect(redirectUrl);
    };
}

• 你的现有实现适合需要展示自定义登录页的场景，逻辑清晰且有效；
• 若无需登录页，推荐使用OAuth2AuthorizationRequestResolver方案，更贴合Spring Security的认证流程，代码更简洁内聚。

内容的提问来源于stack exchange，提问作者Oleg Cohen