13 OAuth 2: Implementing the authorization server

 

This chapter covers

  • Implementing an OAuth 2 authorization server

  • Managing clients for the authorization server

  • Using the OAuth 2 grant types

In this chapter, we’ll discuss implementing an authorization server with Spring Security. As you learned in chapter 12, the authorization server is one of the components acting in the OAuth 2 architecture (figure 13.1). The role of the authorization server is to authenticate the user and provide a token to the client. The client uses this token to access resources exposed by the resource server on behalf of the user. You also learned that the OAuth 2 framework defines multiple flows for obtaining a token. We call these flows grants. You choose one of the different grants according to your scenario. The behavior of the authorization server is different depending on the chosen grant. In this chapter, you’ll learn how to configure an authorization server with Spring Security for the most common OAuth 2 grant types:

  • Authorization code grant type
  • Password grant type
  • Client credentials grant type

You’ll also learn to configure the authorization server to issue refresh tokens. A client uses refresh tokens to obtain new access tokens. If an access token expires, the client has to get a new one. To do so, the client has two choices: reauthenticate using the user credentials or use a refresh token. We discussed the advantages of using refresh tokens over user credentials in section 12.3.4.

13.1 Writing your own authorization server implementation

13.2 Defining user management

13.3 Registering clients with the authorization server

13.4 Using the password grant type

13.5 Using the authorization code grant type

13.6 Using the client credentials grant type

13.7 Using the refresh token grant type

Summary

sitemap