Spring Security

  1. OAuth 2.0 and OpenID Connect (OIDC)
    1. Core OAuth 2.0 Concepts
      1. Roles
        1. Resource Owner
          1. Client
            1. Authorization Server
              1. Resource Server
              2. Grant Types
                1. Authorization Code
                  1. Flow Overview
                    1. Security Considerations
                      1. PKCE Extension
                      2. Client Credentials
                        1. Use Cases
                          1. Flow Overview
                          2. Implicit (Deprecated)
                            1. Deprecation Reasons
                              1. Security Risks
                              2. Resource Owner Password Credentials (Deprecated)
                                1. Use Cases
                                  1. Deprecation Reasons
                                2. Tokens
                                  1. Access Tokens
                                    1. Refresh Tokens
                                      1. Token Scopes
                                        1. Token Expiration
                                      2. Building an OAuth 2.0 Client
                                        1. Configuration with `oauth2Login()`
                                          1. Registering OAuth Providers
                                            1. Client Registration Properties
                                              1. Client ID
                                                1. Client Secret
                                                  1. Authorization URI
                                                    1. Token URI
                                                      1. User Info URI
                                                        1. Redirect URI
                                                      2. Handling User Information
                                                        1. UserInfo Endpoint
                                                          1. Mapping User Attributes
                                                            1. Custom User Attributes
                                                            2. Customizing Client Behavior
                                                              1. Custom OAuth2UserService
                                                                1. Custom OidcUserService
                                                                  1. Custom Authentication Success Handler
                                                                    1. Custom Authentication Failure Handler
                                                                      1. Custom Authorization Request Resolver
                                                                    2. Building an OAuth 2.0 Resource Server
                                                                      1. Configuration with `oauth2ResourceServer()`
                                                                        1. JWT Support
                                                                          1. Opaque Token Support
                                                                          2. Token Validation Strategies
                                                                            1. JWT (JSON Web Token)
                                                                              1. Structure and Claims
                                                                                1. Header Claims
                                                                                  1. Payload Claims
                                                                                    1. Signature Verification
                                                                                      1. JWT Decoder Configuration
                                                                                      2. Opaque Token Introspection
                                                                                        1. Introspection Endpoint
                                                                                          1. Token Validation Process
                                                                                            1. Introspection Client Configuration
                                                                                          2. Extracting Authorities from Tokens
                                                                                            1. Mapping JWT Claims to Authorities
                                                                                              1. Custom Authority Extraction
                                                                                                1. Scope-Based Authorities
                                                                                                  1. Custom JWT Authentication Converter
                                                                                                2. Building an OAuth 2.0 Authorization Server
                                                                                                  1. Spring Authorization Server Project
                                                                                                    1. Overview and Capabilities
                                                                                                      1. Migration from Legacy Authorization Server
                                                                                                      2. Configuration and Endpoints
                                                                                                        1. Authorization Endpoint
                                                                                                          1. Token Endpoint
                                                                                                            1. Token Revocation Endpoint
                                                                                                              1. Token Introspection Endpoint
                                                                                                                1. JWK Set Endpoint
                                                                                                                2. Client Management
                                                                                                                  1. Registered Client Configuration
                                                                                                                    1. Client Authentication Methods
                                                                                                                      1. Client Authorization Grant Types
                                                                                                                      2. Token Customization
                                                                                                                        1. Custom Token Generator
                                                                                                                          1. Custom Claims
                                                                                                                            1. Token Format Configuration
                                                                                                                          2. OpenID Connect (OIDC) 1.0 Support
                                                                                                                            1. OIDC Core Concepts
                                                                                                                              1. ID Token
                                                                                                                                1. UserInfo Endpoint
                                                                                                                                  1. Discovery Endpoint
                                                                                                                                    1. OIDC Scopes
                                                                                                                                    2. Integration with `oauth2Login()`
                                                                                                                                      1. OIDC-Specific Configuration
                                                                                                                                        1. Handling OIDC Claims
                                                                                                                                          1. ID Token Validation
                                                                                                                                          2. OIDC Provider Configuration
                                                                                                                                            1. Discovery Document
                                                                                                                                              1. Provider Metadata
                                                                                                                                                1. Custom Provider Configuration

                                                                                                                                            Previous

                                                                                                                                            5. Web Security Configuration

                                                                                                                                            Go to top

                                                                                                                                            Next

                                                                                                                                            7. Advanced Topics and Integrations