anchor.diff:  [[jc-oauth2login-common-oauth2-provider]]
   ==== CommonOAuth2Provider
   
  -`CommonOAuth2Provider` pre-defines a set of default client properties for a number of _well-known_ Providers, specifically, Google, GitHub, Facebook and Okta.
  -
  -For example, the _authorization-uri_, _token-uri_ and _user-info-uri_ does not change often for a Provider and therefore it makes sense to
  -provide default values in order to reduce the configuration required.
  -
  -As demonstrated previously, when we <<jc-oauth2login-sample-application-config,configured a Google client>>, only the *client-id* and *client-secret* properties were required.
  -
  -For example:
  +`CommonOAuth2Provider` pre-defines a set of default client properties for a number of well known providers: Google, GitHub, Facebook, and Okta.
  +
  +For example, the `authorization-uri`, `token-uri`, and `user-info-uri` do not change often for a Provider. Therefore, it makes sense to
  +provide default values in order to reduce the required configuration.
  +
  +As demonstrated previously, when we <<jc-oauth2login-sample-application-config,configured a Google client>>, only the `client-id` and `client-secret` properties are required.
  +
  +The following listing shows an example:
   
   [source,yaml]
   ----
  
positive.code: }
  ----
  
  The main goal of the `oauth2Login()` DSL was to closely align with the naming as defined in the specifications.
  
  The *OAuth 2.0 Authorization Framework* defines the https://tools.ietf.org/html/rfc6749#section-3[Protocol Endpoints] as follows:
  
  The authorization process utilizes two authorization server endpoints (HTTP resources):
  
  - *Authorization Endpoint* - used by the client to obtain authorization from the resource owner via user-agent redirection.
  - *Token Endpoint* - used by the client to exchange an authorization grant for an access token, typically with client authentication.
  
  As well as one client endpoint:
  
  - *Redirection Endpoint* - used by the authorization server to return responses
  containing authorization credentials to the client via the resource owner user-agent.
  
  The *OpenID Connect Core 1.0* specification defines the http://openid.net/specs/openid-connect-core-1_0.html#UserInfo[UserInfo Endpoint] as follows:
  
  The *UserInfo Endpoint* is an OAuth 2.0 Protected Resource that returns Claims about the authenticated End-User.
  To obtain the requested Claims about the End-User, the Client makes a request to the UserInfo Endpoint
  using an Access Token obtained through OpenID Connect Authentication.
  These Claims are normally represented by a JSON object that contains a collection of name and value pairs for the Claims.
  
  The complete configuration options available for the `oauth2Login()` DSL is as follows:
  
  [source,java]
  ----
  
negative.code: [[oauth2login-advanced-redirection-endpoint]]
  === Redirection Endpoint
  
  The Redirection Endpoint is used by the Authorization Server for returning the Authorization Response
  (which contains the authorization credentials) to the client via the Resource Owner user-agent.
  
  [TIP]
  OAuth 2.0 Login leverages the Authorization Code Grant. Therefore, the authorization credential is the authorization code.
  
  The default Authorization Response `baseUri` (redirection endpoint) is `*/login/oauth2/code/**`, which is defined in `OAuth2LoginAuthenticationFilter.DEFAULT_FILTER_PROCESSES_URI`.
  
  If you would like to customize the _Authorization Response_ `baseUri`, configure it as shown in the following example:
  
  [source,java]
  ----
  