In the previous article, we configured Google OAuth2 Login using Spring Security 7. After a user successfully authenticates with Google, Spring Security retrieves the user's profile information. However, enterprise applications typically need more than just authentication—they need to store user information, assign roles, and manage user accounts.
This is where CustomOAuth2UserService becomes important. It allows us to customize the authentication process after a successful OAuth2 login.
What is CustomOAuth2UserService?
CustomOAuth2UserService extends Spring Security's default OAuth2 user service and gives developers full control over the authenticated user's information.
Common use cases include:
Saving new users in the database
Updating existing user profiles
Assigning default roles
Recording login timestamps
Linking social accounts with existing users
Creating a Custom OAuth2UserService
Create a service that extends DefaultOAuth2UserService.
@Service
public class CustomOAuth2UserService extends DefaultOAuth2UserService {
@Override
public OAuth2User loadUser(OAuth2UserRequest request)
throws OAuth2AuthenticationException {
OAuth2User user = super.loadUser(request);
String email = user.getAttribute("email");
String name = user.getAttribute("name");
return user;
}
}The loadUser() method is called automatically after Google successfully authenticates the user.
Saving Users
After retrieving the user's information, check whether the email already exists in the database.
If the user exists, update the profile information if necessary.
If the user is new, create a new account and assign a default role such as
ROLE_USER.
This approach ensures every authenticated user is available in your application's database.
Why Use Email as the Identifier?
Most OAuth2 providers return a verified email address.
Using email as the unique identifier allows users to log in with the same account across multiple sessions without creating duplicate records.
Production Best Practices
Use the email address as the primary identifier.
Assign the minimum required role during account creation.
Store the provider name (Google, GitHub, Microsoft) for future reference.
Update profile information only when necessary.
Never rely solely on client-side data for authorization decisions.
Summary
In this article, we learned how to customize the OAuth2 authentication process using CustomOAuth2UserService. We also explored how to persist authenticated users in the database and assign default roles automatically. In the next part, we will generate JWT tokens after a successful OAuth2 login, allowing users to access secured REST APIs without maintaining server-side sessions.
