OAuth2, OpenID: SSO under the hood
summary
Builds a minimal SSO flow in Java: constructs the Google authorization URI, performs the redirect, receives an authorization code, POSTs that code to Google’s token endpoint, and decodes the returned ID token JWT to extract claims. Implements the flow manually in Spring Boot to show what an authorization code flow actually does, then shows a safer version using Spring Security. Demonstrates it works locally but omits real verification and warns not to use the demo code in production.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:06OAuth2 and OpenID Connect
- 6:07Why OAuth2 and OpenID exist
- 8:58OAuth2 entities and flows
- 12:54Demo language choice
- 13:58Spring Boot setup
- 20:08Redirect to Google
- 24:52Authorization callback
- 26:12Exchange code for tokens
- 30:12Decoding ID token
- 35:53User data from token
- 36:36OAuth2 security pitfalls
- 36:58Secure OAuth2 with Spring
- 40:46Spring Security auth
- 41:28Resources and closing
related talks
43mOAuth2, OpenID: live-coding SSO, from first principles
01h 03mNext Generation OAuth Support with Spring Security 5.0
50mOAuth2 protocol
54mWho's your user? OpenID from the ground-up
49mUnderstanding OAuth 2.0 & OIDC
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
46mOAuth for Java Developers
01h 02mGetting Started with Spring Authorization Server