Spring social linkedin not sending "state" parameter with oAuth2

Question

I am trying to implement Linkedin social login in a Spring Application; I am using the most recent release spring-social-linkedin-1.0.0.RC4 and spring-social-1.0.3.RELEASE.

I manage to get to the point where authorization link is sent to Linkedin:

https://www.linkedin.com/uas/oauth2/authorization?client_id=....&response_type=code&redirect_uri=....

but the request is sent without the mandatory "state" request parameter, so it always results in an error from Linkedin. I double checked that simply adding the missing parameter to te url by hand results in the correct login page from linkedin, so I know client id is right.

Here's the code I use to connect to Linkedin:

User principal = (User)  SecurityContextHolder.getContext().getAuthentication().getPrincipal();
ConnectionRepository repository = usersConnectionRepository.createConnectionRepository(principal.getUsername());
Connection<LinkedIn> connection = repository.findPrimaryConnection(LinkedIn.class);
    return connection.getApi();

And the configuration for connectionFactoryLocator, where placeholders are resolved correctly:

<bean id="connectionFactoryLocator"
    class="org.springframework.social.connect.support.ConnectionFactoryRegistry">
    <property name="connectionFactories">
        <list>
            <bean
                class="org.springframework.social.linkedin.connect.LinkedInConnectionFactory">
                <constructor-arg value="${linkedin.api.key}" />
                <constructor-arg value="${linkedin.api.secret}" />
            </bean>
        </list>
    </property>
</bean>

Everything else is configured by the book and it's pretty standard spring social + jdbc setup. I think "state" and "scope" parameters should be configured in the same way as "api.key" and "api.secret" (which are correctly set in the request), but I can't find how.

Did someone manage to get this right?

Answer 1

I found out: the simplest way to do it is to use an Interceptor and add it to the ConnectController. You will be able to add any parameter you like there. Or upgrade to spring social 1.1.0 which has automatic state parameter handling (it's currently at RC1 stage).