title: Spring Security custom validation without using user password involved
body: <p>I was wondering if in Spring Security is possible to lock all endpoints of a rest api, and to do a login by doing a custom validation without using the username and password at all.  </p>
  
  <p>It is like create a custom validation method that receives a token and not user/pass.  The method will then validate the token with third party that has already validated the caller.</p>
  
  <p>This sounds familiar to OAuth2 only that the backend API needs to be secure by spring, and at the same time it is not the OAuth2 client:</p>
  
  <ol>
  <li>We are building a login feature.  </li>
  <li>We have a client (mobile app), backend (REST like endpoints Spring MVC), and an AuthProvider for OAuth2/OpenIdConnect flows.</li>
  <li>The OAuth/OpenIDConnect flow happens only between the mobile and OpenIDProvider.  (an initial call happens from mobile to backend to provide some details for oauth flows)</li>
  <li>Once the authorization succeeded, the mobile app receives an auth_code, and only then the backend is called from the app to "Login" which means validate the auth_code, exchange for access_token, and create user session. (we need to have a session).</li>
  <li>As you see backend kind of "login" in the sense that needs to receive the auth_code only, and validate it with the AuthProvider before creating a session. </li>
  </ol>
  
  <p>Thank you very much!</p>
  
  <p>Any comments, or references are very appreciated.  </p>