An authorization server needs to know which applications may request authorization on a user’s behalf. RegisteredClientRepository holds those client details, much as a user repository holds user details. It can find a registered client by its internal ID or client ID. section 8.2
@Bean
public RegisteredClientRepository registeredClientRepository(
PasswordEncoder passwordEncoder) {
RegisteredClient registeredClient =
RegisteredClient.withId(UUID.randomUUID().toString())
.clientId("taco-admin-client")
.clientSecret(passwordEncoder.encode("secret"))
.clientAuthenticationMethod(
ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
.authorizationGrantType(AuthorizationGrantType.REFRESH_TOKEN)
.redirectUri(
"http://127.0.0.1:9090/login/oauth2/code/taco-admin-client")
.scope("writeIngredients")
.scope("deleteIngredients")
.scope(OidcScopes.OPENID)
.clientSettings(
clientSettings -> clientSettings.requireUserConsent(true))
.build();
return new InMemoryRegisteredClientRepository(registeredClient);
}
This bean registers one client in memory. Its details include an encoded secret, supported grant types, a redirect URI, scopes, and a requirement for user consent. section 8.2
The in-memory implementation suits demonstrations and tests. For production, a custom implementation could retrieve client details from a database or another source. section 8.2
