Spring Security is a Java and Spring security framework that helps applications authorize user access and implement authentication patterns such as OpenID Connect (OIDC). It belongs inside a broader security practice: secure design, coding, maintenance, reviews, and analyzers remain necessary because a library alone cannot secure an application. section 1.1.2
A practical deployment separates responsibilities:
- Use Spring Security to manage endpoint authorization within the application. section 12.3
- Use an identity provider (IdP) to authenticate users and manage their credentials. section 12.3
- Configure client credentials, allowed grant types, redirect URIs, and scopes explicitly. section 12.3
- Learn the underlying standards and protocols before treating framework configuration as a black box. section 1.1.2
Protecting an OIDC application
An application can require authentication through a configured IdP while Spring Security manages authorization for its endpoints. A simplified configuration registers an OIDC client, selects the authorization-code grant, accepts a specific redirect URI, and requests the openid scope. The resulting flow discovers the IdP configuration, redirects the user for authentication, receives an authorization code, exchanges it at the token endpoint, and obtains an access token and ID token. section 12.3
Listing 12.1 The authorization code configuration
server:
port: 9000
spring:
security:
user: #1
name: user #1
password: password #1
oauth2: #1
authorizationserver: #1
client: #2
oidc-client:
registration:
client-id: "oidc-client" #3
client-secret: "{noop}secret"
client-authentication-methods: #4
- "client_secret_basic"
authorization-grant-types: #5
- "authorization_code" #5
redirect-uris: #6
- http://127.0.0.1:8080/login/oauth2/code
scopes: #7
- "openid" #7
Inspect the compact YAML configuration showing client authentication, authorization grant type, redirect URI, and scope. section 12.3
