spring boot and google oauth - google-oauth

Question

I've looked at the Oauth2 workflow on Google's docs and it seems pretty intuitive. Using a basic servlet I understand how I'd process all the callbacks, but using Spring Boot I'm a little confused by what I need to do if I'm using oauth and the Spring security module.
I found a tutorial here describing how to add authentication using a username and password, but I'm not sure if this is the best option for my needs as I mostly want to restrict things in the page and not the page itself. Anyway, assuming I will need authentication per page how can I set up a user using Oauth? Looking at the tutorial it appears the security module is doing some magic to get the username/password checked against the in-memory database.
#Configuration
#EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/", "/home").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll();
}
#Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth
.inMemoryAuthentication()
.withUser("user").password("password").roles("USER");
}
}
In the example above I see configureGlobal sets up the username/password store to check against. Does spring boot have hard-coded logic for a username/password that will prevent me from using it for Oauth2? Should I just ignore this security module and set the user directly using my own handlers?

Answer 1

If all you need is to know who Google thinks your user is, you are happy to handle everything yourself you don't necessarily need Spring Security. There is also a Spring Social Google library here that you could use to implement the callbacks.