Implementing an OAuth 2 authorization server with Spring Security - the new way! by Laurentiu Spilca

Spring I/O 2022 - Barcelona, 26-27 May

After project Spring Security OAuth has been deprecated, there was a lot of confusion in the community. You could use Spring Security to write the resource server but not the authorization server. But the dark age is now over.

OAuth 2 and OpenID Connect are tremendously important today since they represent the most used standards for implementing authentication in apps. Spring apps are no exception to this approach. We’ll start with a refresher on OAuth 2 and OpenID Connect and remember shortly how an authorization server was configured using the Spring Security OAuth project (now deprecated). Then, we’ll work on an example where we implement an authorization server using the new approach -the Spring Security Authorization Server project. You’ll learn how to use the new project to write your custom authorization server but also what advantages does this project brings above the old-fashioned way.

[HenrryWithRs]

I love this guys channel. He really knows his stuff.

[adrianstefan]

Laur is a great teacher. I learned a lot from him!

[joshzoolian]

In looking through dozens of sites advising on this topic, it was super handy hearing him mention deprecated methods and implementations

[alxdm]

what about if i dont want jwt tokens? just like the old way which is using opaque token, is it possible? especially if the auth server and reaource server are in one project? hope you can have a demo

[ngocanha]

Rename ProviderSettings -> AuthorizationServerSettings

[nihmathaafiya]

I'm a beginner, I'm not really sure as to how that code_challenge was generated, can someone explain it?

[ridhopratama]

Help. It is statefull, isn't it?? because no sessionCreationPolicy configuration written. like

[rahmonaliyoqubov]

Hi. Can i use a jjwt implementation instead of nimbous jwt?

[yuyeyang]

Does JWT need to be stored on the server?

[陈俏锋]

I love this presentation! How to get the code and file on your presentation?

[fredzouza]

Please can someone help me with the "code_challenge" i need to generate a SHA256 from any string like "anything" and in "code_verifier" i send "anything" ?

[mohamedibrahim]

how the resource server knows this token is from the authorization server? minute 7:36 the diagram misses this point .

[mayankgupta]

Can we have multiple authentication manager configured for different purpose if yes then how?

[csvxmlfan]

at the post request i'll always get {"error":"invalid_client"}, stackoverflow and github show solutions but only for version 0.2.. has someone an idea?

[testingdave]

If I am going to user Redis to store token data, how do I create a filter that will fetch the token first on Redis before proceeding with the checking of JWT? I am planning to use Redis as a cache and Postgresql as the DB

[AnkitKumar-owfg]

I loved the part where he mentioned about Log4J XD

[sergeybayramov]

Is it possible and supported in current version to change formLogin to httpBasic?

[rakeshnukapeyyi]

Where is the code challenge being maintained in the spring backend to validate against the code verifier? If it is in memory, it will cause an issue every time the server is restarted. The authenticated public client might use the non-existent code verifier.

[sadiulhakim]

I am getting error while using BCryptPasswordEncoder instead of NoOpPasswordEncoder. It says Encoded password does not look like BCrypt.

[sabbirtanvir]

why I am getting this error ?
Error creating bean with name 'securityFilterChainAs' defined in class path resource