Authorization server protocol configuration defines the filter and settings that expose authorization server capabilities and customize protocol behavior. A minimal Spring Security setup applies default protocol security, optionally enables OpenID Connect, and routes unauthenticated requests to a login page. Separate security configuration protects application requests and handles authentication mechanisms such as form login. section 14.1
Authorization server protocol configuration
Authorization server protocol configuration is the security configuration that defines and customizes an authorization server's protocol endpoints and capabilities.
How Spring Security in Action, Second Edition covers it
- How deep it goes
- Builds a minimal server configuration with two filter chains and supporting beans, while deferring detailed customizations to a later treatment.
- Examples
- Uses Java SecurityFilterChain beans, an in-memory client, RSA JWK generation, and authorization code, client credentials, and refresh token grants.
- What it assumes
- Assumes basic Spring Security configuration and applies familiar UserDetailsService, PasswordEncoder, authentication, authorization, CORS, and CSRF mechanisms.
- What you can do after
- Build from scratch a minimal Spring Security authorization server with protocol filters, clients, signing keys, and endpoint settings.
- How it connects
- Connects OAuth 2 authorization code and client credentials grants with OpenID Connect, form login, registered clients, and token signing keys.
Related concepts
- OAuth2AuthorizationServerConfigurerconfigured by · OAuth2AuthorizationServerConfigurer is a Spring Security Authorization Server configuration API for configuring OAuth 2 authorization-server protocol endpoints and features.
This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.