Spring Authorization Server

As explained in Spring Security in Action, Second Edition

Spring Security Authorization Server is a Spring-based library for implementing OAuth 2.0 and OpenID Connect authorization servers.

Spring Authorization Server is a Spring-based library for implementing OAuth 2.0 and OpenID Connect authorization servers. It authenticates users and clients, issues tokens, and supports resource-server access. section 14.0

A minimal application starts with the authorization-server starter and separates protocol-endpoint security from ordinary application authentication. Default configuration issues non-opaque tokens. section 14.0 section 14.1

Configure these pieces for a working server:

• Apply protocol-endpoint security, enable OpenID Connect, and route unauthenticated users to login. section 14.1
• Define a second security filter chain with form login and authenticated requests. section 14.1
• Provide user details through UserDetailsService and PasswordEncoder. section 14.1
• Register client identifiers, secrets, authentication methods, redirect URIs, scopes, and grant types with RegisteredClientRepository. section 14.1
• Expose signing material through a JWKSource and configure general endpoints with AuthorizationServerSettings. section 14.1

Grant configuration

A registered client can use authorization_code, client_credentials, and refresh_token grants, with CLIENT_SECRET_BASIC authentication, a redirect URI, and the openid scope. section 14.1

Figure 14.1 Actors in the OAuth 2 scene. The authorization server protects the user and client details and issues tokens the client can use to get authorized when calling the resource server endpoints.

Use the actor diagram to connect the authorization server with users, clients, tokens, and protected resource-server endpoints. section 14.0

How Spring Security in Action, Second Edition covers it

How deep it goes

Builds a minimal server through dependencies, filters, users, clients, signing keys, and settings, then extends it with grants and token features.

Examples

Uses a Spring application with an in-memory user, registered client, RSA key pair, two security filters, and runnable grant-flow tests.

What it assumes

Assumes basic Spring Security authentication configuration and applies UserDetailsService, PasswordEncoder, filters, and request authorization.

What you can do after

Build it from scratch as a Spring authorization server supporting authorization code and client credentials flows.

How it connects

Connects OAuth 2.0, OpenID Connect, authorization code, client credentials, refresh tokens, JWTs, resource servers, and Spring Security authentication.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Spring in Action, Sixth EditionSpring Authorization Server is a Spring project that provides implementation components for building an OAuth2 authorization server.
• 

  liveBookmanning.com
  Software Security for DevelopersSpring Authorization Server is a Spring framework project for building OAuth 2.0 and OpenID Connect authorization servers.

Compare how 3 books explain Spring Authorization Server →

Related concepts

• authorization serverimplements · An authorization server is an OAuth component that authenticates clients or resource owners, obtains authorization, and issues credentials such as authorization codes and access tokens.
• identity providerimplements · An identity provider is a system that authenticates users or other entities and supplies identity information or authentication assertions to relying applications and services.
• authorization code flowimplements · The authorization code flow is an OAuth protocol in which a client obtains a short-lived authorization code after user authorization and exchanges it for access or other tokens.
• openid connectimplements · OpenID Connect is an identity layer built on OAuth 2.0 that enables clients to authenticate end users and obtain standardized identity claims.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.