Spring Authorization Server is a Spring framework project for building an OAuth 2.0 and OpenID Connect authorization server. It can act as an identity provider (IdP) that authenticates users, recognizes client applications, and issues tokens while Spring Security protects application endpoints. section 12.3
A basic client configuration specifies:
- User credentials managed by the IdP. section 12.3
- Client credentials used to authenticate applications. section 12.3
- Allowed grant types, redirect URIs, and requested scopes. section 12.3
Listing 12.1 The authorization code configuration
server:
port: 9000
spring:
security:
user: #1
name: user #1
password: password #1
oauth2: #1
authorizationserver: #1
client: #2
oidc-client:
registration:
client-id: "oidc-client" #3
client-secret: "{noop}secret"
client-authentication-methods: #4
- "client_secret_basic"
authorization-grant-types: #5
- "authorization_code" #5
redirect-uris: #6
- http://127.0.0.1:8080/login/oauth2/code
scopes: #7
- "openid" #7
A concise YAML example configures a local server, a user, an OIDC client, the authorization-code grant, a redirect URI, and the openid scope. section 12.3
Authorization-code flow
A client discovers the provider through its OIDC configuration URL, redirects the user to the authorization endpoint, receives a code at the registered redirect URI, and exchanges that code at the token endpoint. The response contains an access token and ID token; the decoded access token identifies the subject, audience, issuer, scope, and expiration. section 12.3
