title: How do I dynamically specify OAuth2 resource details in Spring Security?
body: <p>I'm creating an application integrating with Shopify's API, which uses OAuth2 for authentication and authorization.  Using <a href="https://spring.io/guides/tutorials/spring-boot-oauth2/" rel="nofollow noreferrer">the tutorial for Spring Security OAuth2</a>, and <a href="https://help.shopify.com/api/getting-started/authentication/oauth" rel="nofollow noreferrer">the tutorial for Shopify</a>, I've been able to get integration working with a single shop.  The YAML configuration looks like this:</p>
  
  <pre><code>shopify:
    shop: myshop
    scopes: read_customers,read_orders
  security:
    oauth2:
      client:
        clientId: myclientid
        clientSecret: mysecret
        tokenName: access_token
        authenticationScheme: query
        clientAuthenticationScheme: form
        accessTokenUri: https://${shopify.shop}.myshopify.com/admin/oauth/access_token
        userAuthorizationUri: https://${shopify.shop}.myshopify.com/admin/oauth/authorize?scope=${shopify.scopes}&amp;grant_options[]=
        pre-established-redirect-uri: https://myapp/login
        registered-redirect-uri: https://myapp/login
        use-current-uri: false
      resource:
        userInfoUri: https://${shopify.shop}.myshopify.com/admin/shop.json
  </code></pre>
  
  <p>However, this static configuration won't work for an app published in Shopify's App Store because the redirect, access token, user info, and user authorization URIs depend on the shop name.  <a href="https://stackoverflow.com/questions/33512401/enableoauth2sso-simultaneously-for-multiple-social-networks/40274971#40274971">There are examples of using more than one provider</a>, but they still have to be static.</p>
  
  <p>To allow these URI's to be dynamic, I've come up with a few possible options:</p>
  
  <ol>
  <li><p>Use a parameter in the <code>/login</code> path to identify the shop, then create a filter that adds the shop name to a <code>ThreadLocal</code> that runs before everything else, then dynamically create the <code>AuthorizationCodeResourceDetails</code> that is needed by the OAuth2 filter via a Spring proxied factory bean.</p></li>
  <li><p>Use a sort of "metafilter" that dynamically recreates the <code>OAuth2ClientAuthenticationProcessingFilter</code> per request along with all of the resources that it needs.</p></li>
  <li><p>Override <code>OAuth2ClientAuthenticationProcessingFilter</code> so that it can handle recreating the <code>RestTemplate</code> it needs to obtain the access token.</p></li>
  </ol>
  
  <p>All of these options seem pretty difficult.  What's a good way to handle dynamically-generated URI's for access tokens and user information in Spring Security OAuth2?</p>
  
  <p>Also, since I'm new to OAuth2 in general, do I need to enable a Resource Server in my Spring configuration to protect my app with the access token?</p>