Next Generation OAuth Support with Spring Security 5.0
summary
Spring Security 5.0 adds client-side OAuth 2.0 and OpenID Connect login using the Authorization Code Grant, demoing Google, GitHub and Okta. With Spring Boot 2 most well‑known providers require two properties (client-id and secret) and the default flow auto‑configures endpoints; Java config needs a ClientRegistrationRepository and http.oauth2Login(). Okta returns a custom authorities claim that maps to Spring GrantedAuthorities so fine‑grained URL rules work; access tokens come from an AuthorizedClientService and are usable with WebClient. Demos succeed; refresh tokens and resource/authorization server work are planned.
AI-written summary · about
chapters (15)
- 0:00Introduction and setup
- 1:55OAuth2 login overview
- 3:01Spring Boot auto-configuration
- 6:57Google login demo
- 12:19Minimal configuration for providers
- 13:22GitHub login setup
- 18:36Java configuration for OAuth2 login
- 22:45Mapping user authorities
- 27:59Octa login and authority mapping
- 37:59Questions on OAuth2 login
- 42:24Access tokens and protected resources
- 47:28Access token retrieval demo
- 52:16Simplified access token use in 5.1
- 56:07Future OAuth2 features and timeline
- 1:00:37Q&A and resources
related talks
53mNext Generation OAuth Support with Spring Security 5
43mOAuth2, OpenID: live-coding SSO, from first principles
42mOAuth2, OpenID: SSO under the hood
49mSpring Security 5: Demystifying Cloud Identity
46mOAuth for Java Developers
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
48mExplain it to Me Like I’m 5: Oauth2 and OpenID
54mHow to secure your Spring Apps with Keycloak