A client ID is an externally visible value that uniquely identifies an OAuth client to an authorization server. Unlike the internal ID, it identifies the client in protocol requests; unlike the client secret, it is not the client’s password. section 14.1
Use the client ID as part of the client’s registered configuration:
- Set it when registering an application with an OAuth provider, then place it in the client application’s properties. section 16.1.1
- Configure a separate client ID for each provider when users may authenticate with multiple providers such as Google and GitHub. section 16.1.2
- Register resource servers as clients with their own client ID and secret when they call an introspection endpoint. section 15.3
Spring Security registration
A Google login uses properties such as spring.security.oauth2.client.registration.google.client-id=790… and a matching client secret. A resource server similarly uses resourceserver.clientID=resource_server when authenticating to the authorization server. section 16.1.1 section 15.3
Listing 14.4 Implementing client details management
@Bean
public RegisteredClientRepository registeredClientRepository() {
RegisteredClient registeredClient = #1
RegisteredClient #1
.withId(UUID.randomUUID().toString()) #1
.clientId("client") #1
.clientSecret("secret") #1
.clientAuthenticationMethod(
ClientAuthenticationMethod.CLIENT_SECRET_BASIC) #1
.authorizationGrantType( #1
AuthorizationGrantType.AUTHORIZATION_CODE) #1
.redirectUri("https://www.manning.com/authorized") #1
.scope(OidcScopes.OPENID) #1
.build(); #1
return new InMemoryRegisteredClientRepository
(registeredClient); #2
}
#1 Creating a RegisteredClient instance
#2 Adding it to be managed by the in-memory RegisteredClientRepository implementation
Inspect the RegisteredClient configuration to see the client ID alongside the internal ID, secret, authentication method, grant type, redirect URI, and scope. section 14.1
