Getting Started with Spring Authorization Server
0 likes3,034 views
This document outlines the essentials of getting started with the Spring Authorization Server, detailing various security standards like OAuth 2.1 and OpenID Connect. It describes core components, default configurations, and methods for customizing both authorization and client authentication. Additionally, it includes links to sample branches and a roadmap for future developments.
Getting Started with Spring Authorization Server
- 1. Getting Started with Spring Authorization Server Joe Grandja @joe_grandja Steve Riesenberg @sjohnr
- 2. Security Standards ● OAuth 2.1 Authorization Framework ● OAuth 2.0 Token Revocation ● OAuth 2.0 Token Introspection ● JSON Web Token (JWT) ● JSON Web Key (JWK) ● JSON Web Signature (JWS) ● OpenID Connect Core 1.0 ● OpenID Connect Discovery 1.0 ● OpenID Connect Dynamic Client Registration 1.0
- 3. Core Components / Default Configuration ● RegisteredClientRepository / RegisteredClient ● OAuth2AuthorizationService / OAuth2Authorization ● OAuth2AuthorizationConsentService / OAuth2AuthorizationConsent ● JWKSource<SecurityContext> (Nimbus API) ● ProviderSettings ● OAuth2AuthorizationServerConfiguration / OAuth2AuthorizationServerConfigurer
- 4. Customizing Authorization ● Authorization Endpoint ● Insufficient Redirect URI Validation ● Mix-Up ● Authorization Code Injection
- 5. Customizing Client Authentication ● Mutual-TLS Client Authentication ● Client Certificate-Bound Access Tokens ● Token Replay Prevention
- 7. Roadmap ● OpenID Connect Core 1.0 ● JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication ● OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens ● Resource Indicators for OAuth 2.0
- 8. Thank you! ● Spring Authorization Server ○ https://github.com/spring-projects/spring-authorization-server ● Sample branches ○ https://github.com/jgrandja/spring-authorization-server/tree/springone-2021 ○ https://github.com/sjohnr/spring-authorization-server/tree/springone-2021 Joe Grandja @joe_grandja Steve Riesenberg @sjohnr