Getting Started with Spring Authorization Server
summary
Spring Authorization Server implements OAuth 2.1 and OpenID Connect basics, adds JWT and opaque token support, a pluggable OAuth 2 token generator and token customizer, and exposes provider metadata and JWKs. The demo builds and runs a mutual TLS client-auth flow that mints certificate-bound access tokens (thumbprint claim) and verifies them at the resource server; certificate issuance uses SPIRE for workload identities. Audience-restriction by resource URI is also shown and works.
AI-written summary · about
chapters (11)
- 0:00Introduction to project
- 1:32Agenda and talk overview
- 3:40Current features and OAuth 2.1
- 6:39Core model and components
- 11:58Token generation and provider
- 15:28Default configuration
- 21:06Customizing the server
- 26:01Request processing pipeline
- 29:00Token leakage mitigations
- 33:48Demo and implementation
- 56:57Roadmap and Q&A
related talks
51mEnterprise Security with Spring Authorization Server 1.0
45mImplementing an OAuth 2 authorization server with Spring Security - the new way!
48mThe new Spring Security
56mSecured REST Microservices with Spring Cloud
50mOAuth2 protocol
01h 31mSecurity for Microservices with Spring and OAuth2
51mEverything new in Spring Security 6 baked with a Spring Boot 3 recipe
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew