Securing OAuth 2.0 Resources in Spring Security 5.0

The OAuth 2.0 Authorization Framework is elaborate, with several nuances and subtleties that can make it overwhelming for implementers. Its strength and flexibility, have propelled it to an industry standard; quite often organizations look to frameworks to ensure correct implementation.
Spring Security 5.0 marked the beginning of a long-term mission that the Spring Security team has to simplify Spring’s support for OAuth 2.0. Last year, it began with OAuth 2.0 Login over OpenID Connect 1.0. And this year that journey continues to now include additional OAuth 2.0 Client features and the first release of OAuth 2.0 Resource Server support.
In this talk, we’ll take a look at two insecure applications--one a web application and the other a REST API--and integrate them both with an OAuth 2.0 Authorization Server. The first will feature Spring Security’s most recent OAuth 2.0 Client feature set and the second, its newly-released Resource Server support.
For the web application, we’ll configure the client to use the Authorization Code Grant flow. For the REST API, we’ll configure the resource server for JWT support, OAuth2-specific authorization expressions, and JWK set resolution. Finally, we’ll put it all together, logging into our application and retrieving a secure resource.

Speakers:
Josh Cummings
Principal Software Engineer, Pivotal
Joe Grandja
Staff Software Engineer, Pivotal
Filmed at SpringOne Platform 2018

[qwalers]

The only and best tutorial about Spring Security 5.0 with OAuth2 and JWT with IAM/UAA server

[flatmapper]

15:28 is it available not only in spring data repos?

[mikeklein]

To all those triggered by Spring...if you dont like the water stay out of the pool! Spring is THE best way to deal with the complexities of developing distributed applications. It's a work of art.

[rajatagrawal]

where is the github link for this project please someone provide me

[pranavkhandelwal]

Very informative and helpful video. Thanks a lot.

[kennethmarete]

Why are we scrapping off the oauth2 and resource server on spring 2.5.6 and above?

[arithmeticerror]

@Josh Cummings

Guys you make changes in resource server & restart client and say its working as expected (timestamp 44:03). The one assumption both the presenters are making is everyone who is watching the video knows the overall application they are using, the client aspect & are well versed in each aspect of oauth, which is not at true

Rob's presentations used to be so good when it comes to Spring Security. Now a days, the presentations are mere presentations, with very little emphasis on making them understandable

[samuellarico]

You guys are amazing, my life was saved

[kappaj]

Great presentation guys. Some excellent information to get you going as well. Keep up the good work!

[sebastianszczebiot]

Can you help me plese?
After running: .\gradlew -b uaa-server\build.gradle cargoRunLocal
I get such an error: Failed to start the Tomcat 8.x container. Check the file containing the container logs for more details.

[LennarthAnaya]

"with several nuances and subtleties that can make it overwhelming for implementers"... right, to be honest, hopefully this video will help, thanks

[Gregor_]

Is that ok to have spring security 5.1.0.RELEASE as a dependency, and call a video Spring Security 5.0?

[rydmerlin]

Is there a better tutorial on this topic than this one? This doesn't appear to be a topic that lends itself well to a bottom up explanation. By all means start with some Restful services that don't require authentication and then go thru the steps necessary to provide it. I also find the way the code is displayed to be difficult to follow and there's generally too many context switches to follow what's going on.

[nikhilkant]

The presentation is really great .please share the code link.