Spring Authorization Server
Spring Authorization Server is a Spring project for building OAuth 2.0 and OpenID Connect authorization servers.
Spring in Action, Sixth Edition
Spring Authorization Server is a Spring project that provides implementation components for building an OAuth2 authorization server.
- How it is used
- Builds a separate OAuth 2 authorization server that issues access tokens for clients calling a protected API.
- How deep it goes
- Walks through project setup, security configuration, client registration, and token requests, while deferring repository implementation details.
- Examples
- Uses a Taco Cloud client, a registered-client configuration, a curl token exchange, and a bearer-token request to the ingredients API.
- What you can do after
- Build it from scratch as a separate Spring Boot authorization server and obtain a token for a protected API request.
Read how Spring in Action, Sixth Edition explains Spring Authorization Server →
Spring Security in Action, Second Edition
Spring Security Authorization Server is a Spring-based library for implementing OAuth 2.0 and OpenID Connect authorization servers.
- How it is used
- Implements customizable OAuth 2.0 and OpenID Connect authorization servers within Spring applications.
- How deep it goes
- Builds a minimal server through dependencies, filters, users, clients, signing keys, and settings, then extends it with grants and token features.
- Examples
- Uses a Spring application with an in-memory user, registered client, RSA key pair, two security filters, and runnable grant-flow tests.
- What you can do after
- Build it from scratch as a Spring authorization server supporting authorization code and client credentials flows.
Read how Spring Security in Action, Second Edition explains Spring Authorization Server →
Software Security for Developers
Spring Authorization Server is a Spring framework project for building OAuth 2.0 and OpenID Connect authorization servers.
- How it is used
- Uses a Spring-based identity provider to authenticate users and protect application endpoints through OAuth 2.0 and OpenID Connect.
- How deep it goes
- Demonstrates client configuration and an authorization-code exchange but deliberately stops short of detailed framework implementation.
- Examples
- Uses a local YAML configuration, discovery URL, authorization request, redirect callback, token request, and decoded JWT access token.
- What you can do after
- Configure it via Spring and exercise an authorization-code flow that produces access and ID tokens for a registered client.
Read how Software Security for Developers explains Spring Authorization Server →
Related concepts
- authorization serverimplements · An authorization server is an OAuth component that authenticates clients or resource owners, obtains authorization, and issues credentials such as authorization codes and access tokens.
- identity providerimplements · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.
- authorization code flowimplements · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
- openid connectimplements · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.