title: Android login via Google Sign-In with a Spring Boot backend
body: <p>As the title says, I'm trying to use the Google Sign-In API with a Spring Boot backend server, as described <a href="https://developers.google.com/identity/sign-in/android/backend-auth" rel="noreferrer">here</a>.</p>
  
  <p>Just to describe the context, the Spring backend is basically a resource+authentication server, that is currently providing Oauth2 authentication to a second spring boot application containing the frontend website, via Google SSO or simple form login (similar to what's described <a href="https://spring.io/guides/tutorials/spring-boot-oauth2/#_social_login_authserver" rel="noreferrer">here</a>).</p>
  
  <p>My original idea was to mimic the <em>@EnableOauth2Sso</em> annotation by simply providing an access token to the android app and attach it to every request as "Bearer ".
  Using the user credentials for this was pretty straightforward: I simply make a request to the server at "/oauth/token", using those credentials inserted by the user as authentication and I correctly receive the access token.</p>
  
  <p>Now, I have absolutely no idea on how to build a similar procedure with the Google API in Android. The tutorial page I linked before describes how to get a token ID and how the server should validate it, but <strong>after that</strong> I don't know what to do.</p>
  
  <p>So far I've managed to add a filter to the security chain that simply checks the token like this:</p>
  
  <pre><code>    private Authentication attemptOpenIDAuthentication(@NonNull String tokenString){
          String clientId = authServices.getClientId();
          GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, factory)
          .setAudience(Arrays.asList(clientId, androidClient))
          .build();
  
          try {
              GoogleIdToken token = verifier.verify(tokenString);
              if (token != null) {
                  return authServices.loadAuthentication(token.getPayload());
              } else {
                  throw new InvalidTokenException("ID token is null");
              }
          } catch (GeneralSecurityException | IOException e) {
              throw new BadCredentialsException("Could not validate ID token");
          }
      }
  </code></pre>
  
  <p>This manages indeed to create an Authentication object, but <strong>how can I generate an access token after the authentication filtering?</strong></p>
  
  <p>To recap, so far I've got:</p>
  
  <ol>
  <li><p>The Android app successfully retrieves the Google token ID and sends it to the server</p></li>
  <li><p>The server sucessfully intercepts the request and validates the token</p></li>
  </ol>
  
  <p>I'm basically missing the third point where I return a proper access token to the Android client.
  Here you are a simple scheme to better understand the situation:
  <a href="https://i.stack.imgur.com/0WrDy.png" rel="noreferrer"><img src="https://i.stack.imgur.com/0WrDy.png" alt="Crappy scheme of the problem. Web frontend is working great, android is missing Google login."></a></p>
  
  <p>Is there any other way to validate the token <strong>and</strong> get an access token from the server, or should I completely change the authentication procedure on Android?</p>