title: Spring Security 5 - How to SSO from id_token (Google one-tap)
body: <p>I'm working on an application with Spring Boot 5 and OIDC. I've configured OIDC with Google and it works fine. I'm redirected to login at Google and then it redirects me to the app creating a new session. Now I'm trying to use <a href="https://developers.google.com/identity/one-tap/web" rel="nofollow noreferrer">Google One-Tap</a>. It works fine as well. When user clicks on the one-tap's modal to continue with his Google identity I receive a POST with the id_token. What I want to do is to create a Spring session from this POST as it is created when user is logged by OIDC. </p>
  
  <p>I think the right way is to create a <code>Filter</code> extending <code>AbstractAuthenticationProcessingFilter</code>. I've found some references <a href="https://www.baeldung.com/spring-security-openid-connect-legacy" rel="nofollow noreferrer">here</a> and <a href="https://github.com/spring-projects/spring-security/blob/master/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/web/OAuth2LoginAuthenticationFilter.java" rel="nofollow noreferrer">here</a> but I don't have the <code>access_token</code> when receiving the one-tap POST:</p>
  
  <pre class="lang-java prettyprint-override"><code>public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
          ...
          OAuth2AuthenticationToken oauth2Authentication = new OAuth2AuthenticationToken(
              authenticationResult.getPrincipal(),
              authenticationResult.getAuthorities(),
              authenticationResult.getClientRegistration().getRegistrationId());
          oauth2Authentication.setDetails(authenticationDetails);
  
          OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient(
              authenticationResult.getClientRegistration(),
              oauth2Authentication.getName(),
              authenticationResult.getAccessToken(),
              authenticationResult.getRefreshToken());
  
          this.authorizedClientRepository.saveAuthorizedClient(authorizedClient, oauth2Authentication, request, response);
  
          return oauth2Authentication;
  }
  </code></pre>
  
  <p>Has anyone tried to do it before ?</p>