Next Generation OAuth Support with Spring Security 5
summary
Spring Security 5 adds built-in OAuth 2.0 Login and OpenID Connect support using the Authorization Code Grant, plus planned resource-server (5.1) and later authorization-server work while old Spring Security OAuth gets retired. Configuration uses Spring Boot 2 properties like spring.security.oauth2.client.registration and provider entries, supports multiple clients, and provides sensible defaults for Google/Facebook/GitHub/Okta so you often supply client-id + client-secret only. Demo shows custom GrantedAuthorities mapping from the userinfo payload and using @OAuth2AuthorizedClient plus WebClient to fetch GitHub repos successfully.
AI-written summary · about
chapters (21)
- 0:00Intro
- 7:55Audience
- 12:31Registration
- 13:24Client Authentication
- 15:13Authorization
- 16:06Login Pattern
- 16:47Scopes
- 17:22Authentication
- 17:55Description Field
- 18:42Core Protocol Endpoints
- 19:00User Info Endpoint
- 21:19Username Attribute
- 22:13JwkSetURI
- 22:58Google OAuth
- 25:28Demo
- 27:28How did I work
- 30:44Client Registration Repository
- 33:10Testing
- 35:10Custom Authority Mapping
- 38:50User Configuration
- 45:10Demonstration
related talks
01h 03mNext Generation OAuth Support with Spring Security 5.0
49mSpring Security 5: Demystifying Cloud Identity
01h 02mGetting Started with Spring Authorization Server
43mOAuth2, OpenID: live-coding SSO, from first principles
46mOAuth for Java Developers
48mThe new Spring Security
48mExplain it to Me Like I’m 5: Oauth2 and OpenID
42mOAuth2, OpenID: SSO under the hood