# Post process Okta auth code flow

**URL:** <https://devforum.okta.com/t/post-process-okta-auth-code-flow/6093>\
**Category:** Questions\
**Created:** [August 27, 2019, 9:46pm UTC](https://devforum.okta.com/t/post-process-okta-auth-code-flow/6093 "2019-08-27T21:46:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jgkenned](https://avatars.discourse-cdn.com/v4/letter/j/3ec8ea/32.png) [@jgkenned](https://devforum.okta.com/u/jgkenned)\
**Post date:** [August 27, 2019, 9:46pm UTC](https://devforum.okta.com/t/post-process-okta-auth-code-flow/6093/1 "2019-08-27T21:46:50Z")

</div>

I’ve developed a basic application using Spring Boot 2.1.7. Here is a snippet of my WebSecurityConfig:

```
protected void configure(HttpSecurity http) throws Exception
{
    http.authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .oauth2Login()
        .successHandler(customOauthLoginSuccessHandler())
        .failureHandler(customOauthLoginFailureHandler())
        .and()
        .oauth2Client();

    http.csrf().disable();
}

```

I have an application.yml that is correctly configured with issuer, client-id and client-secret. Also, I have configured a custom success handler which gets fired after login.

All resources are secured so accessing [http://localhost:8080/](http://localhost:8080/) correctly sends me to the Okta login and there I can enter my credentials and get redirected back to localhost to display a hello world page. It is a basic working example that can be found easily.

I’ve been trying, without success, to implement custom code that can be injected in the authentication flow. The placement of the code should be after back-channel http requests are complete but before the success handler is called. The purpose of this custom code is to use the loginId (unique username from Okta) to lookup additional information about the user within an Oracle database. This additional information cannot be stored on the Okta side. This additional information would have to be available as part of the AuthenticationToken so that it can be retrieved downstream (in the success handler for instance).

My initial attempt was to create a custom AuthenticationProvider (AP), but that proved to be an incorrect approach since targeted placement of my AP was not possible. I then created a custom OidcUserService, however I did not have the ability to extend the Okta implementation because it is declared final. I continued down this path and attempted to add my own more vanilla OidcUserService. Here is the updated http security configure method:

```
protected void configure(HttpSecurity http) throws Exception
{
    http.authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .oauth2Login()
        .userInfoEndpoint()
        .oidcUserService(new CustomOidcUserService())
        .and()
        .successHandler(customOauthLoginSuccessHandler())
        .failureHandler(customOauthLoginFailureHandler())
        .and()
        .oauth2Client();

    http.csrf().disable();
}

```

This approach did not work because assignment of the OktaOidcUserService comes after the assignment of my CustomOidcUserService. Mine gets overwritten by the Okta version. I need some advice on how I should approach this problem. How can I inject my own custom code to add additional information to the Authentication object.

I’ve done something very similar with a past SAML implementation and Spring. I was quite easy to integrate my custom flow into the Spring-SAML flow. I created a custom user details class in the case.

Gradle info:

```
dependencies {
  implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
  implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
  implementation 'org.springframework.boot:spring-boot-starter-security'
  implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
  implementation 'org.springframework.boot:spring-boot-starter-web'
  implementation 'com.okta.spring:okta-spring-boot-starter:1.2.1'
  developmentOnly 'org.springframework.boot:spring-boot-devtools'
  runtimeOnly 'com.h2database:h2'
  testImplementation 'org.springframework.boot:spring-boot-starter-test'
  testImplementation 'org.springframework.security:spring-security-test'
}
```

---

<div class="post-metadata">

**Author:** ![bdemers](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/bdemers/32/23_2.png) [@bdemers](https://devforum.okta.com/u/bdemers)\
**Post date:** [August 28, 2019, 2:49pm UTC](https://devforum.okta.com/t/post-process-okta-auth-code-flow/6093/2 "2019-08-28T14:49:50Z")

</div>

There is a similar item on our backlog: [https://github.com/okta/okta-spring-boot/issues/136](https://github.com/okta/okta-spring-boot/issues/136)  
Let’s move the conversation over there.

I’ve had a conversation with another user in the same boat and they basically wanted to pull an attribute out of the access token, and then add some custom Authorities to the current user.

Can you comment on that issue with an example of how you will use the data that is added? (I have a few ideas of ways to expose this, I just want to make sure it lines up with your actual usage)

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 7:19pm UTC](https://devforum.okta.com/t/post-process-okta-auth-code-flow/6093/3 "2024-01-23T19:19:31Z")

</div>

Closed on January 23, 2024, 7:19pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.