OAuth2AuthorizationRequest.additionalParameters should not contain registration_id

[jgrandja]

When DefaultOAuth2AuthorizationRequestResolver creates an OAuth2AuthorizationRequest it saves the clientRegistration.getRegistrationId() as follows:

		Map<String, Object> additionalParameters = new HashMap<>();
		additionalParameters.put(OAuth2ParameterNames.REGISTRATION_ID, clientRegistration.getRegistrationId());

Then OAuth2LoginAuthenticationFilter retrieves the registrationId via OAuth2AuthorizationRequest.additionalParameters() in order to lookup the ClientRegistration using ClientRegistrationRepository during Authorization Response processing.

We should avoid storing the registrationId in OAuth2AuthorizationRequest.additionalParameters() as this may cause issues when a user configures their own OAuth2AuthorizationRequestResolver and overrides additionalParameters with their custom request parameters and does not include the registrationId.

[rwinch]

NOTE: To whom fixes this issue please check the reactive equivalent when this issue is resolved

[jgrandja]

We should consider introducing OAuth2AuthorizationRequest.attributes (of type Map<String, Object>), which would serve the similar purpose as ServletRequest.getAttribute() and RequestAttributes. The registrationId would than be stored in OAuth2AuthorizationRequest.attributes.

This makes a lot of sense as I'm anticipating we'll need a place to store contextual information associated to an Authorization Request while it's in flight during a grant flow. And we should not mix request parameters with request context attributes.