<div dir="ltr"><div><div><div><div><div><div><div><div><div>Hi there,<br><br></div>If my IDP leverages 3rd party to authenticate user, how do I build authentication and principle based upon the the authentication result returned by 3rd party?<br><br></div>For example, <br>1. user clicks "login with Facebook account" on the login page provided by my IDP.<br></div>2. user is redirected to Facebook's login page<br></div>3. user submits username + password to Facebook<br></div>4. Facebook redirects user back to my IDP with authentication result<br></div>5. my IDP uses the USERID returned by Facebook to lookup username in my user base<br></div>6. my IDP creates OAuth2Authentication entity as if the user successfully authenticates himself with his username + password on my IDP<br></div>7. my IDP creates OAuth2AccessTokenEntity with createAccessToken method provided in DefaultOAuth2ProviderTokenService.java, so counter party can access OAuth protected API with the access token.<br></div><div>8. another counter party redirects the same user to my IDP, my IDP is able to tell that the user is already authenticated and generates new access token for this counter party.<br></div><div><br></div>If user authenticates himself with my IDP, everything is taken cared of by spring-security filters. However, in this case we only receives authentication result from 3rd party, so I really need a hand on how to do step 6, 7, and 8.<br><br>Thank you.<br><div><div><div><div><div><div><div><div><div><div><br><div><div><br clear="all"><div><div><div class="gmail_signature">This is a UTF-8 formatted mail<br>-----------------------------------------------<br>James C.-C.Yu<br>+886988713275<br></div></div>
</div></div></div></div></div></div></div></div></div></div></div></div></div></div>