OpenID Connect (OIDC) is a protocol built over OAuth 2 that narrows implementation choices to improve compatibility between authentication and authorization systems. It adds defined scopes such as openid and profile and introduces an ID token for user details. section 13.4
An OIDC-enabled OAuth 2 system coordinates these roles and mechanisms:
- The user authenticates; the client requests authorization; the authorization server manages identities and issues tokens; and the resource server protects resources. section 13.6
- Authorization code, client credentials, refresh tokens, and optional PKCE support different token-issuance scenarios. section 13.6
- Access tokens may be opaque, requiring introspection, or non-opaque JWTs containing user and client details. section 13.6
Enable OIDC in Spring Security
Configure the authorization-server filter with applyDefaultSecurity(http), then call oidc(Customizer.withDefaults()) on OAuth2AuthorizationServerConfigurer. Add a login entry point for /login, configure form login and authenticated requests in a second filter chain, and order the chains explicitly. section 14.1
Listing 14.1 Implementing the filter for configuring protocol endpoints
@Bean
@Order(1)
public SecurityFilterChain asFilterChain(HttpSecurity http)
throws Exception {
OAuth2AuthorizationServerConfiguration #1
.applyDefaultSecurity(http); #1
http.getConfigurer(
OAuth2AuthorizationServerConfigurer.class) #2
.oidc(Customizer.withDefaults()); #2
http.exceptionHandling((e) ->
e.authenticationEntryPoint(
new LoginUrlAuthenticationEntryPoint("/login")) #3
);
return http.build();
}
The annotated configuration shows the minimal protocol-endpoint filter and the explicit OIDC enablement step. section 14.1
