Spring Security using OAuth2 in Spring Boot | Tech Primers

This video covers the Spring Security with OAuth2 in Spring Boot

📌 Related Playlist
================

🎬Video Editing: iMovie

🎼Background Music: Broke For Free - Day Bird
The Passion HiFi - What We Came To Do
Joakim Karud

---------------------------------------------------------------
🔥 Disclaimer/Policy:
The content/views/opinions posted here are solely mine and the code samples created by me are open sourced.
You are free to use the code samples in Github after forking and you can modify it for your own use.
All the videos posted here are copyrighted. You cannot re-distribute videos on this channel in other channels or platforms.
#SpringSecurity #OAuth2 #TechPrimers

[toml]

Great content; the best, simplified explanation of oAuth2 with Spring Boot I've come across. Keep up the good work!

[tvrajesh]

It would have been great if you had provided a detailed explanation on why some methods are overridden from Spring and the use of it with different options. However, this video is a great starting point to analyze further ourselves.

[mahichakri]

Nice informative video. I liked the way it is explained and coded simultaneously. One thing is i observed is, some of the configurations used are deprecated in the latest spring boot 2.X or later. Users need to note that the example demonstrated is in SpringBoot 1.5.6, which should have been the latest one at that moment :)

[viveksingh-rtpy]

Hi Ajay,

Excellent explanation. Very well done.

May I ask one question. We can restrict API access inside a resource server based on Role. In your video you have mentioned that Auth Service can be from google and resource server can be on local machine. If validation happens at Google then how role will be assigned. Google role may not be relevant for our local resource server .

Thanks,
Vivek

[erickloningo]

Thanks man, just saved my life. live long

[AmineC]

also very nice work with editing the video, gives a professional feel to it

[RajKumar-wfnm]

Thanks Buddy for sharing your experience and knowledge...

[PraveenKumar-pxbw]

Simple and straight forward, Very good indeed. Thank you.

[biplabdatta]

hi, i want to know, do we need to use oauth2 if we want to login in our application through FB or other application credentials, or if we create our application where user needs to register and with those credential only need to login then alos we can use oauth2. Or just using jwt token we can achieve this without oauth2.Looking for your input

[shobhanganta]

Nice video with In depth understanding of concept

[geekgeeks]

Thank you so much Ajay..Its of great help to me :) God bless you

[tekieshub]

Thank you very much, very good tutorial on OAuth2

[rktechie]

I liked your problem-solving skills, Thank you.

[michaelwijayagames]

A pretty superb tutorial from tech primers..
Hope this could be helpful for some people..
Something to mention:
For auth-server has some deprecated function for version 2 :
application property should be :
server.port=8081


and there is a need to make extends WebSecurityConfigurerAdapter
to create bean function

@Bean(name =
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return
}


because @Autowired authenticationManager is not being supported for th Spring version 2

while security.basic.enable=false already deprecated so we need to change things to disable http basic security by not using spring-security-starter..


For the client server:

We need to change deprecated extends WebMvcConfigurerAdapter to just implement the WebMvcConfigurer

Need to change application.yml configuration into:

server:
port: 8084
#for running behind proxy purpose
use-forward-headers: true
servlet:
context-path: /ui
session:
cookie:
path: UISESSION



Adios and amigos.

[microsoftsoft]

Nice video, good explanation, I have a question, can I implement OAuth2 authorization with code flow to call an API from another API?

[javaframeworks]

Resource server application is having protected resources which can be accessed only through access token and that token has to be issued through separate application that is authorization server.

[haster]

setting the token in the cookie is a major vulnerability !!! the correct implementation is that the auth code shall be sent to the server side by web redirect, and then it shall be used in a server to server call to acquire the access token. the access token shall only be used on the back channel, which is the server to server call. single page applications can utilize PKCE update on the auth code grant type.

[MarcoLopez-ggdl]

Thanks for the tutorial.
How can I perform this authentication to protect my REST API and test it from the POSTMAN?
How could I customize the login.html with css?
The ClientId, Secret, those come from somewhere or do I define them?

[skd]

Very good tutorial..thank you so much. Could you please explain why was the oAuth extra dependency required?

[msnawaz]

Thank you so much. It is totally worthful.