Getting Started with Spring Authorization Server

The Spring Authorization Server project provides support for OAuth 2.1 Authorization Framework, OpenID Connect Core 1.0 and the numerous extension specifications.

The primary goal of this talk is to demonstrate how to securely configure a Spring Authorization Server deployment using identified trust boundaries. The IETF draft, OAuth 2.0 Security Best Current Practice, will be referenced and recommendations will be provided for preventing attacks and implementing mitigations using defense in depth strategies.

The following will be discussed and demonstrated.

- Current Features
- Starting up with default configuration
- Customizing the configuration
- Adding custom features via extension
- Feature Roadmap

Joe Grandja is a core committer on the Spring Security team. He has been leading the efforts in building the next generation of OAuth 2 and OpenID Connect support in Spring Security and Spring Authorization Server.

With over 25 years of industry experience, his job roles have covered Solution Architect, Software Engineer, Team Lead and Consultant. His past experience has been mainly focused in the Financial Services sector in the Toronto, Canada area. He has designed, built and delivered enterprise grade banking applications/platforms in the Personal/Commercial and Brokerage/Investing divisions. He has worked closely with the InfoSec teams within the banks to ensure security and regulatory compliance.

[sameersarmah]

Immensely explanatory session. Great in depth walkthrough of the Spring Authorization server API. Joe explains all the relevant concepts e.g PKCE.
I personally had to pause frequently to read Javadoc every time Joe was introducing a new API.🙂

[amitpccsful]

Can you please share the git repo, to take a loot at code?

[azharmobeen]

Thanks for sharing with us, But you didn't explain about client credentials, any helping metrial/example how we can achieve OAuth2 with Client credentials with custom authorization server. Please advise

[markjaysongonzaga]

Do we have a documentation about the oauth2-authorization-server? like customizing login page adding additional fields aside from the default username and password? Thanks

[walterfeliperosadoestrada]

Im searching how make that but to grant_type client credentials. Help me!!

[mahdi-]

I am interested to integrate Spring Authorization Server with a mongo database also I have active users in my database, I wonder if it can work perfectly the a mongo database or it's not supported yet