OAuth2, OpenID: live-coding SSO, from first principles
summary
Live-codes a minimal SSO: a Java Spring Boot web app sends users to Google’s authorization endpoint from accounts.google.com/.well-known/openid-configuration, receives a one‑time authorization code, POSTs that code plus client_id/client_secret and redirect URI to the token endpoint, and extracts the ID token (JWT) payload to populate a session. Uses Java Rest client and ObjectMapper, then shows the production alternative with Spring Security and the spring-boot-starter-oauth2-client. Demo succeeds end-to-end but explicitly skips JWT signature verification.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:24OAuth2 and OpenID Connect
- 7:46OAuth2 entities and flow
- 10:37Demo setup
- 12:02Java demo app
- 13:24OAuth2 login button
- 21:38Callback and code exchange
- 23:24Code for ID token
- 28:44ID token data
- 35:51Spring Security OAuth2
- 39:26Summary and Q&A
related talks
42mOAuth2, OpenID: SSO under the hood
01h 03mNext Generation OAuth Support with Spring Security 5.0
54mWho's your user? OpenID from the ground-up
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
48mThe new Spring Security
46mOAuth for Java Developers
43mIdentity crisis: bending Spring Security to your advanced use-cases
49mUnderstanding OAuth 2.0 & OIDC