Redirected from /spring-projects/spring-authorization-server
Spring Authorization Server

https://github.com/spring-attic/spring-authorization-server
Admin
Spring Authorization Server provides OAuth 2.1 and OpenID Connect 1.0 support to build secure,...
Tokens:269,945
Snippets:1,467
Trust Score:9
License:Apache-2.0
Update:1 week ago
Show doc for...
Tokens:
Raw
### SecurityConfig.java

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-ext-grant-type.adoc

Configuration example showing how to add the AuthenticationConverter and AuthenticationProvider to the OAuth2 Token endpoint configuration.

```java
include::{examples-dir}/main/java/sample/extgrant/SecurityConfig.java[]
```

--------------------------------

### Configure client registrar with ClientConfig.java

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-dynamic-client-registration.adoc

Example client configuration for registering new clients. Must have client_credentials grant type, client.create scope, and optionally client.read scope.

```java
include::{examples-dir}/main/java/sample/registration/ClientConfig.java[]
```

--------------------------------

### Install all spring-* jars into local Maven cache

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/README.adoc

Runs the Gradle task to publish all Spring Authorization Server artifacts to the local Maven cache. This is required before building the project.

```bash
./gradlew publishToMavenLocal

```

--------------------------------

### Encode client credentials with base64

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-dynamic-client-registration.adoc

Command to base64 encode client credentials in the format <clientId>:<clientSecret>. Example uses registrar-client:secret.

```console
echo -n "registrar-client:secret" | base64
```

--------------------------------

### Token Request with Authorization Code and PKCE

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Example of a token request using the authorization code grant with PKCE. The request includes grant_type, client_id, code, redirect_uri, and code_verifier parameters.

```http
grant_type=authorization_code\
&client_id=s6BhdRkqt\
&code=SplxlOBeZQQYbYS6WxSbIA\
&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb\
&code_verifier=bEaL42izcC-o-xBk0K2vuJ6U-y1p9r_wW2dFWIWgjz-
```

--------------------------------

### Example OIDC Provider Configuration Metadata for Tenant Issuer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-multitenancy.adoc

Shows the configuration metadata returned for a tenant issuer with a path component, such as 'http://localhost:9000/issuer1'. The issuer identifier with a path component represents the tenant identifier.

```json
{
  "issuer": "http://localhost:9000/issuer1",
  "authorization_endpoint": "http://localhost:9000/issuer1/oauth2/authorize",
  "token_endpoint": "http://localhost:9000/issuer1/oauth2/token",
  "jwks_uri": "http://localhost:9000/issuer1/oauth2/jwks",
  "revocation_endpoint": "http://localhost:9000/issuer1/oauth2/revoke",
  "introspection_endpoint": "http://localhost:9000/issuer1/oauth2/introspect",
  ...
}
```

--------------------------------

### Configure OAuth2AuthorizationService via OAuth2AuthorizationServerConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Shows how to configure the OAuth2AuthorizationService through the OAuth2AuthorizationServerConfigurer within a SecurityFilterChain bean. The example is incomplete in the source and only shows the beginning of the configuration method.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();
```

--------------------------------

### Minimal SecurityConfig.java for Spring Authorization Server

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/getting-started.adoc

Defines the minimum required components as @Bean definitions in a Spring @Configuration. This minimal configuration is for getting started quickly; it includes a filter chain for protocol endpoints, a filter chain for authentication, a UserDetailsService, a RegisteredClientRepository, a JWKSource, a KeyPair, a JwtDecoder, and AuthorizationServerSettings.

```java
include::{docs-java}/sample/gettingstarted/SecurityConfig.java[]
```

--------------------------------

### Configure OAuth2 Token Endpoint with OAuth2TokenEndpointConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to customize the OAuth2 Token endpoint by setting access token request converters, authentication providers, and response handlers. The example uses the OAuth2AuthorizationServerConfigurer and HttpSecurity to build the security filter chain.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.tokenEndpoint(tokenEndpoint ->
                    tokenEndpoint
                        .accessTokenRequestConverter(accessTokenRequestConverter)   <1>
                        .accessTokenRequestConverters(accessTokenRequestConvertersConsumer) <2>
                        .authenticationProvider(authenticationProvider) <3>
                        .authenticationProviders(authenticationProvidersConsumer)   <4>
                        .accessTokenResponseHandler(accessTokenResponseHandler) <5>
                        .errorResponseHandler(errorResponseHandler) <6>
				)
		);

	return http.build();
}
```

--------------------------------

### Configure OidcClientRegistrationEndpoint with custom converters, providers, and handlers

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to configure the clientRegistrationEndpoint within the OidcClientRegistrationEndpointConfigurer. The endpoint is disabled by default. The example sets a custom AuthenticationConverter, a Consumer for the converter list, an AuthenticationProvider, a Consumer for the provider list, an AuthenticationSuccessHandler, and an AuthenticationFailureHandler.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
                .oidc(oidc ->
                    oidc
                        .clientRegistrationEndpoint(clientRegistrationEndpoint ->
                            clientRegistrationEndpoint
                                .clientRegistrationRequestConverter(clientRegistrationRequestConverter) <1>
                                .clientRegistrationRequestConverters(clientRegistrationRequestConvertersConsumers)  <2>
                                .authenticationProvider(authenticationProvider) <3>
                                .authenticationProviders(authenticationProvidersConsumer)   <4>
                                .clientRegistrationResponseHandler(clientRegistrationResponseHandler)   <5>
                                .errorResponseHandler(errorResponseHandler) <6>
                        )
                )
		);

	return http.build();
}
```

--------------------------------

### Configure OAuth2AuthorizationServerConfigurer with SecurityFilterChain

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/configuration-model.adoc

Shows how to create a SecurityFilterChain bean that uses OAuth2AuthorizationServerConfigurer to customize the authorization server. The example sets a security matcher and configures core components and endpoints via lambda expressions. The numbered comments (e.g., <1>, <2>) correspond to the configuration options listed in the documentation.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.registeredClientRepository(registeredClientRepository)	<1>
				.authorizationService(authorizationService)	<2>
				.authorizationConsentService(authorizationConsentService)	<3>
				.authorizationServerSettings(authorizationServerSettings)	<4>
				.tokenGenerator(tokenGenerator)	<5>
				.clientAuthentication(clientAuthentication -> { })	<6>
				.authorizationEndpoint(authorizationEndpoint -> { })	<7>
				.pushedAuthorizationRequestEndpoint(pushedAuthorizationRequestEndpoint -> { })  <8>
				.deviceAuthorizationEndpoint(deviceAuthorizationEndpoint -> { })	<9>
				.deviceVerificationEndpoint(deviceVerificationEndpoint -> { })	<10>
				.tokenEndpoint(tokenEndpoint -> { })	<11>
				.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint -> { })	<12>
				.tokenRevocationEndpoint(tokenRevocationEndpoint -> { })	<13>
				.authorizationServerMetadataEndpoint(authorizationServerMetadataEndpoint -> { })	<14>
				.oidc(oidc -> oidc
					.providerConfigurationEndpoint(providerConfigurationEndpoint -> { })	<15>
					.logoutEndpoint(logoutEndpoint -> { })	<16>
					.userInfoEndpoint(userInfoEndpoint -> { })	<17>
					.clientRegistrationEndpoint(clientRegistrationEndpoint -> { })	<18>
				)
		);
```

--------------------------------

### POST /oauth2/token (DPoP Token Request)

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Example of a token request using the authorization code grant with a DPoP proof. The request includes the code verifier and the DPoP proof JWT in the header.

```APIDOC
## POST /oauth2/token

### Description
Exchanges an authorization code for an access token using the authorization code grant with DPoP proof.

### Method
POST

### Endpoint
/oauth2/token

### Parameters
#### Request Body
- **grant_type** (string) - Required - Must be `authorization_code`.
- **client_id** (string) - Required - The client identifier.
- **code** (string) - Required - The authorization code.
- **redirect_uri** (string) - Required - The redirect URI used in the authorization request.
- **code_verifier** (string) - Required - The PKCE code verifier.

### Request Example
```
grant_type=authorization_code\
&client_id=s6BhdRkqt\
&code=SplxlOBeZQQYbYS6WxSbIA\
&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb\
&code_verifier=bEaL42izcC-o-xBk0K2vuJ6U-y1p9r_wW2dFWIWgjz-
```

### Response
#### Success Response (200)
- **access_token** (string) - The access token.
- **token_type** (string) - The token type, set to `DPoP`.
- **expires_in** (integer) - The lifetime in seconds.

#### Response Example
```
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
 "access_token": "Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU",
 "token_type": "DPoP",
 "expires_in": 2677
}
```
```

--------------------------------

### UserRepositoryOAuth2UserHandler

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-social-login.adoc

An example Consumer<OAuth2User> that stores users in-memory. It can be plugged into the FederatedIdentityAuthenticationSuccessHandler to capture users in a database or other data store.

```java
include::{samples-dir}/demo-authorizationserver/src/main/java/sample/federation/UserRepositoryOAuth2UserHandler.java[tags=imports;class]
```

--------------------------------

### Access Token Response with token_type DPoP

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Example HTTP response from the token endpoint showing an access token bound to a DPoP proof. The token_type parameter is set to 'DPoP' to indicate the binding.

```shell
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
 "access_token": "Kz~8mXK1EalYznwH-LC-1fBAo.4Ljp~zsPE_NeO.gxU",
 "token_type": "DPoP",
 "expires_in": 2677
}
```

--------------------------------

### Configure OAuth2 Token Revocation Endpoint with OAuth2AuthorizationServerConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to configure the token revocation endpoint using the OAuth2AuthorizationServerConfigurer. The example sets a security matcher and uses the tokenRevocationEndpoint method to customize the revocation request converter, authentication provider, and response handlers.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.tokenRevocationEndpoint(tokenRevocationEndpoint ->
                    tokenRevocationEndpoint
                        .revocationRequestConverter(revocationRequestConverter) <1>
                        .revocationRequestConverters(revocationRequestConvertersConsumer)   <2>
                        .authenticationProvider(authenticationProvider) <3>
                        .authenticationProviders(authenticationProvidersConsumer)   <4>
                        .revocationResponseHandler(revocationResponseHandler)   <5>
                        .errorResponseHandler(errorResponseHandler) <6>
				)
		);
}
```

--------------------------------

### Configure OAuth2AuthorizationEndpointConfigurer with custom converters, providers, handlers, and consent page

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to customize the OAuth2 Authorization endpoint using the OAuth2AuthorizationServerConfigurer. The example sets a custom authorizationRequestConverter, a consumer for authorizationRequestConverters, an authenticationProvider, a consumer for authenticationProviders, an authorizationResponseHandler, an errorResponseHandler, and a custom consentPage URI. The securityMatcher is set to the endpoints matcher and the configurer is applied to the HttpSecurity.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.authorizationEndpoint(authorizationEndpoint ->
					authorizationEndpoint
        				.authorizationRequestConverter(authorizationRequestConverter)   <1>
                        .authorizationRequestConverters(authorizationRequestConvertersConsumer) <2>
                        .authenticationProvider(authenticationProvider) <3>
                        .authenticationProviders(authenticationProvidersConsumer)   <4>
                        .authorizationResponseHandler(authorizationResponseHandler) <5>
                        .errorResponseHandler(errorResponseHandler) <6>
                        .consentPage("/oauth2/v1/authorize")    <7>
				)
		);

	return http.build();
}
```

--------------------------------

### Configure OAuth2PushedAuthorizationRequestEndpoint with custom converters and handlers

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to customize the pushed authorization request endpoint by adding converters, authentication providers, and response handlers. The example uses the authorizationServerConfigurer to configure the endpoint within a SecurityFilterChain.

```java
http
	.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
	.with(authorizationServerConfigurer, (authorizationServer) ->
		authorizationServer
			.pushedAuthorizationRequestEndpoint(pushedAuthorizationRequestEndpoint ->
				pushedAuthorizationRequestEndpoint
        			.pushedAuthorizationRequestConverter(pushedAuthorizationRequestConverter)   <1>
                        .pushedAuthorizationRequestConverters(pushedAuthorizationRequestConvertersConsumer) <2>
                        .authenticationProvider(authenticationProvider) <3>
                        .authenticationProviders(authenticationProvidersConsumer)   <4>
                        .pushedAuthorizationResponseHandler(pushedAuthorizationResponseHandler) <5>
                        .errorResponseHandler(errorResponseHandler) <6>
			)
	);

return http.build();
}
```

--------------------------------

### Configure Token Introspection Endpoint

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Java configuration example for customizing the OAuth2 token introspection endpoint using OAuth2AuthorizationServerConfigurer. It shows how to set custom converters, authentication providers, and response handlers.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint ->
                    tokenIntrospectionEndpoint
                        .introspectionRequestConverter(introspectionRequestConverter)   <1>
                        .introspectionRequestConverters(introspectionRequestConvertersConsumer) <2>
                        .authenticationProvider(authenticationProvider) <3>
                        .authenticationProviders(authenticationProvidersConsumer)   <4>
                        .introspectionResponseHandler(introspectionResponseHandler) <5>
                        .errorResponseHandler(errorResponseHandler) <6>
				)
		);
}
```

--------------------------------

### DPoP Proof JWT Generation

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Example Java code to generate a DPoP proof JWT using the Nimbus JOSE + JWT library. The proof includes the HTTP method and URI as claims.

```APIDOC
## DPoP Proof JWT Generation

### Description
Generates a DPoP proof JWT to be used as a header in token requests.

### Method
N/A (Client-side generation)

### Endpoint
N/A

### Parameters
#### Request Body
- **htm** (string) - The HTTP method (e.g., POST).
- **htu** (string) - The HTTP URI.
- **iat** (integer) - Issued-at time.
- **jti** (string) - Unique identifier.

### Request Example
```java
RSAKey rsaKey = ...
JWKSource<SecurityContext> jwkSource = (jwkSelector, securityContext) -> jwkSelector
		.select(new JWKSet(rsaKey));
NimbusJwtEncoder jwtEncoder = new NimbusJwtEncoder(jwkSource);

JwsHeader jwsHeader = JwsHeader.with(SignatureAlgorithm.RS256)
		.type("dpop+jwt")
		.jwk(rsaKey.toPublicJWK().toJSONObject())
		.build();
JwtClaimsSet claims = JwtClaimsSet.builder()
		.issuedAt(Instant.now())
		.claim("htm", "POST")
		.claim("htu", "https://server.example.com/oauth2/token")
		.id(UUID.randomUUID().toString())
		.build();

Jwt dPoPProof = jwtEncoder.encode(JwtEncoderParameters.from(jwsHeader, claims));
```

### Response
No response - this is a client-side operation.
```

--------------------------------

### Configure OAuth2 Device Verification Endpoint with OAuth2DeviceVerificationEndpointConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to customize the OAuth2 Device Verification endpoint by setting converters, authentication providers, response handlers, and a consent page. The example uses the OAuth2AuthorizationServerConfigurer within a SecurityFilterChain bean.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.deviceVerificationEndpoint(deviceVerificationEndpoint ->
                    deviceVerificationEndpoint
                        .deviceVerificationRequestConverter(deviceVerificationRequestConverter) <1>
                        .deviceVerificationRequestConverters(deviceVerificationRequestConvertersConsumer)   <2>
                        .authenticationProvider(authenticationProvider) <3>
                        .authenticationProviders(authenticationProvidersConsumer)   <4>
                        .deviceVerificationResponseHandler(deviceVerificationResponseHandler)   <5>
                        .errorResponseHandler(errorResponseHandler) <6>
                        .consentPage("/oauth2/v1/consent")  <7>
				)
		);
}
```

--------------------------------

### Customize OAuth2 Token Revocation Endpoint with OAuth2TokenRevocationEndpointConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Configures the OAuth2 Token Revocation endpoint by customizing the AuthenticationConverter, AuthenticationProvider, AuthenticationSuccessHandler, and AuthenticationFailureHandler. The example shows how to use the revocationRequestConverter(), revocationRequestConverters(), authenticationProvider(), authenticationProviders(), revocationResponseHandler(), and errorResponseHandler() methods.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.tokenRevocationEndpoint(tokenRevocationEndpoint ->
					tokenRevocationEndpoint
						.revocationRequestConverter(revocationRequestConverter)   <1>
						.revocationRequestConverters(revocationRequestConvertersConsumer)   <2>
						.authenticationProvider(authenticationProvider)   <3>
						.authenticationProviders(authenticationProvidersConsumer)   <4>
						.revocationResponseHandler(revocationResponseHandler)   <5>
						.errorResponseHandler(errorResponseHandler)   <6>
				)
		);

	return http.build();
}
```

--------------------------------

### Configure OidcLogoutAuthenticationProvider with custom authentication validator

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to set a custom Consumer<OidcLogoutAuthenticationContext> validator on OidcLogoutAuthenticationProvider via the logoutEndpoint authenticationProviders method. The validator must throw OAuth2AuthenticationException on failure. The example includes a placeholder CustomPostLogoutRedirectUriValidator class.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
                .oidc(oidc ->
                    oidc
                        .logoutEndpoint(logoutEndpoint ->
                            logoutEndpoint
                                .authenticationProviders(configureAuthenticationValidator())
                        )
                )
		);

	return http.build();
}

private Consumer<List<AuthenticationProvider>> configureAuthenticationValidator() {
	return (authenticationProviders) ->
			authenticationProviders.forEach((authenticationProvider) -> {
				if (authenticationProvider instanceof OidcLogoutAuthenticationProvider oidcLogoutAuthenticationProvider) {
					Consumer<OidcLogoutAuthenticationContext> authenticationValidator = new CustomPostLogoutRedirectUriValidator();
					OidcLogoutAuthenticationProvider.setAuthenticationValidator(authenticationValidator);
				}
			});
}

static class CustomPostLogoutRedirectUriValidator implements Consumer<OidcLogoutAuthenticationContext> {

	@Override
	public void accept(OidcLogoutAuthenticationContext authenticationContext) {
		OidcLogoutAuthenticationToken oidcLogoutAuthentication =
				authenticationContext.getAuthentication();
		RegisteredClient registeredClient = authenticationContext.getRegisteredClient();

		// TODO

	}
}
```

--------------------------------

### Generate DPoP Proof JWT with NimbusJwtEncoder

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Java code example showing how to generate a DPoP Proof JWT using NimbusJwtEncoder. It creates a JWS header with type 'dpop+jwt' and the RSA public key, and claims with htm, htu, and a random jti.

```java
RSAKey rsaKey = ...
JWKSource<SecurityContext> jwkSource = (jwkSelector, securityContext) -> jwkSelector
		.select(new JWKSet(rsaKey));
NimbusJwtEncoder jwtEncoder = new NimbusJwtEncoder(jwkSource);

JwsHeader jwsHeader = JwsHeader.with(SignatureAlgorithm.RS256)
		.type("dpop+jwt")
		.jwk(rsaKey.toPublicJWK().toJSONObject())
		.build();
JwtClaimsSet claims = JwtClaimsSet.builder()
		.issuedAt(Instant.now())
		.claim("htm", "POST")
		.claim("htu", "https://server.example.com/oauth2/token")
		.id(UUID.randomUUID().toString())
		.build();

Jwt dPoPProof = jwtEncoder.encode(JwtEncoderParameters.from(jwsHeader, claims));
```

--------------------------------

### Configure JwtClientAssertionAuthenticationProvider with custom JwtClientAssertionDecoderFactory

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/configuration-model.adoc

Shows how to customize JwtClientAssertionDecoderFactory to validate an additional claim in the Jwt client assertion. The example configures the authorization server's client authentication to use a custom validator factory that delegates to the default validators and adds a JwtClaimValidator for the 'claim' claim.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.clientAuthentication(clientAuthentication ->
					clientAuthentication
						.authenticationProviders(configureJwtClientAssertionValidator())
				)
		);

	return http.build();
}

private Consumer<List<AuthenticationProvider>> configureJwtClientAssertionValidator() {
	return (authenticationProviders) ->
		authenticationProviders.forEach((authenticationProvider) -> {
			if (authenticationProvider instanceof JwtClientAssertionAuthenticationProvider) {
				// Customize JwtClientAssertionDecoderFactory
				JwtClientAssertionDecoderFactory jwtDecoderFactory = new JwtClientAssertionDecoderFactory();
				Function<RegisteredClient, OAuth2TokenValidator<Jwt>> jwtValidatorFactory = (registeredClient) ->
					new DelegatingOAuth2TokenValidator<>(
						// Use default validators
						JwtClientAssertionDecoderFactory.DEFAULT_JWT_VALIDATOR_FACTORY.apply(registeredClient),
						// Add custom validator
						new JwtClaimValidator<>("claim", "value"::equals));
				jwtDecoderFactory.setJwtValidatorFactory(jwtValidatorFactory);

				((JwtClientAssertionAuthenticationProvider) authenticationProvider)
					.setJwtDecoderFactory(jwtDecoderFactory);
			}
		});
}
```

--------------------------------

### Configure OAuth2AuthorizationCodeRequestAuthenticationProvider with custom redirect_uri validator

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Shows how to override the default redirect_uri validator with a custom one that allows localhost, while reusing the default scope validator. The custom validator must throw OAuth2AuthorizationCodeRequestAuthenticationException on failure. The example includes a SecurityFilterChain bean and a static inner class implementing Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext>.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.authorizationEndpoint(authorizationEndpoint ->
					authorizationEndpoint
                        .authenticationProviders(configureAuthenticationValidator())
				)
		);

	return http.build();
}

private Consumer<List<AuthenticationProvider>> configureAuthenticationValidator() {
	return (authenticationProviders) ->
		authenticationProviders.forEach((authenticationProvider) -> {
			if (authenticationProvider instanceof OAuth2AuthorizationCodeRequestAuthenticationProvider) {
				Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> authenticationValidator =
					// Override default redirect_uri validator
					new CustomRedirectUriValidator()
						// Reuse default scope validator
						.andThen(OAuth2AuthorizationCodeRequestAuthenticationValidator.DEFAULT_SCOPE_VALIDATOR);

				((OAuth2AuthorizationCodeRequestAuthenticationProvider) authenticationProvider)
					.setAuthenticationValidator(authenticationValidator);
			}
		});
}

static class CustomRedirectUriValidator implements Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> {

	@Override
	public void accept(OAuth2AuthorizationCodeRequestAuthenticationContext authenticationContext) {
		OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication =
			authenticationContext.getAuthentication();
		RegisteredClient registeredClient = authenticationContext.getRegisteredClient();
		String requestedRedirectUri = authorizationCodeRequestAuthentication.getRedirectUri();

		// Use exact string matching when comparing client redirect URIs against pre-registered URIs
		if (!registeredClient.getRedirectUris().contains(requestedRedirectUri)) {
			OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST);
			throw new OAuth2AuthorizationCodeRequestAuthenticationException(error, null);
		}
	}
}
```

--------------------------------

### Compile, test, and build all artifacts

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/README.adoc

Runs the Gradle build to compile, test, and build all jars, distribution zips, and documentation. Use './gradlew tasks' to discover more commands.

```bash
./gradlew build

```

--------------------------------

### Enable Dynamic Client Registration with SecurityConfig.java

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-dynamic-client-registration.adoc

Add this configuration to enable the OpenID Connect 1.0 Client Registration Endpoint with default configuration. Optionally customize the default AuthenticationProviders to support custom client metadata parameters.

```java
include::{examples-dir}/main/java/sample/registration/SecurityConfig.java[]
```

--------------------------------

### Register a client with ClientRegistrar.java

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-dynamic-client-registration.adoc

Java code to dynamically register a client using the initial access token. The access token can only be used once and is invalidated after registration.

```java
include::{examples-dir}/main/java/sample/registration/ClientRegistrar.java[]
```

--------------------------------

### OAuth2 Token Introspection Endpoint Configuration

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Java configuration example for customizing the OAuth2 Token Introspection endpoint using the Spring Authorization Server's OAuth2TokenIntrospectionEndpointConfigurer.

```APIDOC
## OAuth2 Token Introspection Endpoint Configuration

### Description
Configures the OAuth2 Token Introspection endpoint with custom converters, authentication providers, and response handlers.

### Method
N/A (Configuration)

### Endpoint
/oauth2/introspect (implied)

### Parameters
#### Configuration Options
- **introspectionRequestConverter** - Custom converter for introspection requests.
- **introspectionRequestConverters** - Consumer to add additional converters.
- **authenticationProvider** - Custom authentication provider.
- **authenticationProviders** - Consumer to add additional providers.
- **introspectionResponseHandler** - Custom response handler.
- **errorResponseHandler** - Custom error response handler.

### Request Example
```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.tokenIntrospectionEndpoint(tokenIntrospectionEndpoint ->
                    tokenIntrospectionEndpoint
                        .introspectionRequestConverter(introspectionRequestConverter)   <1>
                        .introspectionRequestConverters(introspectionRequestConvertersConsumer) <2>
                        .authenticationProvider(authenticationProvider) <3>
                        .authenticationProviders(authenticationProvidersConsumer)   <4>
                        .introspectionResponseHandler(introspectionResponseHandler) <5>
                        .errorResponseHandler(errorResponseHandler) <6>
				)
		);
}
```

### Response
No response - this is a configuration.
```

--------------------------------

### Obtain initial access token

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-dynamic-client-registration.adoc

HTTP request to obtain an initial access token. The scope parameter must contain only client.create. The access token is used for client registration and can only be used once.

```httprequest
POST /oauth2/token HTTP/1.1
Authorization: Basic <base64-encoded-credentials>
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&scope=client.create
```

--------------------------------

### Enable OpenID Connect 1.0 with OidcConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/configuration-model.adoc

Initializes the OidcConfigurer by calling .oidc(Customizer.withDefaults()) on the OAuth2AuthorizationServerConfigurer. This adds OpenID Connect 1.0 protocol endpoints (Provider Configuration, Logout, UserInfo) to the default endpoints. The Client Registration endpoint remains disabled by default.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();
	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.oidc(Customizer.withDefaults())	// Initialize `OidcConfigurer`
		);
	return http.build();
}
```

--------------------------------

### Apache License header for new classes

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/CONTRIBUTING.adoc

Add this Apache License header to all new classes. It includes the copyright notice and the full license text.

```java
/*
 * Copyright 2020-2021 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
```

--------------------------------

### Apply minimal default configuration with OAuth2AuthorizationServerConfiguration

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/configuration-model.adoc

Use @Import(OAuth2AuthorizationServerConfiguration.class) to apply the minimal default configuration. Requires a RegisteredClientRepository bean and a JWKSource<SecurityContext> bean; the JWK Set endpoint is only configured if the JWKSource bean is present. A user authentication mechanism must be configured separately for the authorization_code grant.

```java
@Configuration
@Import(OAuth2AuthorizationServerConfiguration.class)
public class AuthorizationServerConfig {

	@Bean
	public RegisteredClientRepository registeredClientRepository() {
		List<RegisteredClient> registrations = ...
		return new InMemoryRegisteredClientRepository(registrations);
	}

	@Bean
	public JWKSource<SecurityContext> jwkSource() {
		RSAKey rsaKey = ...
		JWKSet jwkSet = new JWKSet(rsaKey);
		return (jwkSelector, securityContext) -> jwkSelector.select(jwkSet);
	}

}
```

--------------------------------

### JWT Access Token with cnf Claim

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/protocol-endpoints.adoc

Example JSON claims of a JWT access token that includes a cnf claim with a jkt claim, which is the JWK SHA-256 Thumbprint of the DPoP proof public key.

```json
{
  "sub":"user@example.com",
  "iss":"https://server.example.com",
  "nbf":1562262611,
  "exp":1562266216,
  "cnf":
  {
    "jkt":"CQMknzRoZ5YUi7vS58jck1q8TmZT8wiIiXrCN1Ny4VU"
  }
}
```

--------------------------------

### Enable certificate-bound access tokens for a client

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/configuration-model.adoc

Shows how to configure a RegisteredClient to enable certificate-bound access tokens by setting x509CertificateBoundAccessTokens to true in TokenSettings. This binds the access token to the client's X.509 certificate via a SHA-256 thumbprint, enabling proof-of-possession during protected resource access.

```java
RegisteredClient mtlsClient = RegisteredClient.withId(UUID.randomUUID().toString())
		.clientId("mtls-client")
		.clientAuthenticationMethod(ClientAuthenticationMethod.TLS_CLIENT_AUTH)
		.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
		.scope("scope-a")
		.clientSettings(
				ClientSettings.builder()
						.x509CertificateSubjectDN("CN=mtls-client,OU=Spring Samples,O=Spring,C=US")
						.build()
		)
		.tokenSettings(
				TokenSettings.builder()
						.x509CertificateBoundAccessTokens(true)
						.build()
		)
		.build();
```

--------------------------------

### OAuth2TokenGenerator

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

The OAuth2TokenGenerator interface is responsible for generating OAuth2Token instances from the information in an OAuth2TokenContext. It is an optional component that defaults to a DelegatingOAuth2TokenGenerator composed of OAuth2AccessTokenGenerator and OAuth2RefreshTokenGenerator. The following example shows how to register a custom OAuth2TokenGenerator as a Spring bean.

```APIDOC
## OAuth2TokenGenerator

### Description
The OAuth2TokenGenerator interface is responsible for generating an OAuth2Token from the information contained in the provided OAuth2TokenContext. The generated token type depends on the OAuth2TokenType specified in the context. It is an optional component that defaults to a DelegatingOAuth2TokenGenerator composed of an OAuth2AccessTokenGenerator and OAuth2RefreshTokenGenerator.

### Method
Bean registration

### Endpoint
N/A

### Parameters
None

### Request Example
```java
@Bean
public OAuth2TokenGenerator<?> tokenGenerator() {
	JwtEncoder jwtEncoder = ...
	JwtGenerator jwtGenerator = new JwtGenerator(jwtEncoder);
	OAuth2AccessTokenGenerator accessTokenGenerator = new OAuth2AccessTokenGenerator();
	OAuth2RefreshTokenGenerator refreshTokenGenerator = new OAuth2RefreshTokenGenerator();
	return new DelegatingOAuth2TokenGenerator(
			jwtGenerator, accessTokenGenerator, refreshTokenGenerator);
}
```

### Response
No response. The method returns an OAuth2TokenGenerator instance.
```

--------------------------------

### Custom client metadata converter configuration

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-dynamic-client-registration.adoc

Sample implementation of Converters that support custom client metadata parameters (logo_uri and contacts) and are configured in OidcClientRegistrationAuthenticationProvider and OidcClientConfigurationAuthenticationProvider.

```java
include::{examples-dir}/main/java/sample/registration/CustomClientMetadataConfig.java[]
```

--------------------------------

### Configure application.yml for Google social login

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/samples/README.adoc

Set the spring.security.oauth2.client.registration property with the google-idp registration ID. Replace client-id and client-secret with your Google OAuth 2.0 credentials, or use the GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET environment variables.

```yaml
spring:
  security:
    oauth2:
      client:
        registration:	<1>
          google-idp:	<2>
            provider: google
            client-id: google-client-id
            client-secret: google-client-secret

```

--------------------------------

### OAuth2TokenGenerator Configuration via OAuth2AuthorizationServerConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Alternatively, you can configure the OAuth2TokenGenerator through the OAuth2AuthorizationServerConfigurer. This is useful when applying multiple configuration options simultaneously.

```APIDOC
## OAuth2TokenGenerator Configuration via OAuth2AuthorizationServerConfigurer

### Description
This example shows how to configure the OAuth2TokenGenerator through the OAuth2AuthorizationServerConfigurer. This approach is useful when applying multiple configuration options simultaneously.

### Method
Bean registration

### Endpoint
N/A

### Parameters
None

### Request Example
```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.tokenGenerator(tokenGenerator)
		)
	    ...

	return http.build();
}
```

### Response
No response. The method returns a SecurityFilterChain.
```

--------------------------------

### Add Spring Boot Starter for Spring Authorization Server (Maven)

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/getting-started.adoc

Add the spring-boot-starter-oauth2-authorization-server dependency to your Maven pom.xml to use Spring Authorization Server with Spring Boot.

```xml
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-authorization-server</artifactId>
</dependency>
```

--------------------------------

### Register RegisteredClientRepository as a Bean

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Shows how to define a RegisteredClientRepository bean using InMemoryRegisteredClientRepository. The repository is required and the in-memory implementation is recommended only for development and testing.

```java
@Bean
public RegisteredClientRepository registeredClientRepository() {
	List<RegisteredClient> registrations = ...
	return new InMemoryRegisteredClientRepository(registrations);
}
```

--------------------------------

### Clone the Spring Authorization Server repository

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/README.adoc

Clones the Spring Authorization Server source code from GitHub. This is the first step to build the project from source.

```bash
git clone git@github.com:spring-projects/spring-authorization-server.git

```

--------------------------------

### Add Spring Boot Starter for Spring Authorization Server (Gradle)

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/getting-started.adoc

Add the spring-boot-starter-oauth2-authorization-server dependency to your Gradle build to use Spring Authorization Server with Spring Boot.

```gradle
implementation "org.springframework.boot:spring-boot-starter-oauth2-authorization-server"
```

--------------------------------

### Configure RegisteredClient for authorization_code grant in Java

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Shows how to build a RegisteredClient with the authorization_code grant type, using a client secret with the {noop} PasswordEncoder id, and requiring consent. The client ID is 'client-a', redirect URI is 'http://127.0.0.1:8080/authorized', and scope is 'scope-a'.

```java
RegisteredClient registeredClient = RegisteredClient.withId(UUID.randomUUID().toString())
	.clientId("client-a")
	.clientSecret("{noop}secret")   <1>
	.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
	.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
	.redirectUri("http://127.0.0.1:8080/authorized")
	.scope("scope-a")
	.clientSettings(ClientSettings.builder().requireAuthorizationConsent(true).build())
	.build();
```

--------------------------------

### Configure RegisteredClientRepository via OAuth2AuthorizationServerConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Shows how to configure the RegisteredClientRepository through the OAuth2AuthorizationServerConfigurer within a SecurityFilterChain bean. This approach is useful when applying multiple configuration options simultaneously.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.registeredClientRepository(registeredClientRepository)
		)
	    ...

	return http.build();
}
```

--------------------------------

### RegisteredClient class definition with metadata fields

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Shows the Java class definition of RegisteredClient, listing its metadata fields such as id, clientId, clientSecret, and various sets for authentication methods, grant types, redirect URIs, scopes, and settings.

```java
public class RegisteredClient implements Serializable {
	private String id;  <1>
	private String clientId;    <2>
	private Instant clientIdIssuedAt;   <3>
	private String clientSecret;    <4>
	private Instant clientSecretExpiresAt;  <5>
	private String clientName;  <6>
	private Set<ClientAuthenticationMethod> clientAuthenticationMethods;    <7>
	private Set<AuthorizationGrantType> authorizationGrantTypes;    <8>
	private Set<String> redirectUris;   <9>
	private Set<String> postLogoutRedirectUris; <10>
	private Set<String> scopes; <11>
	private ClientSettings clientSettings;  <12>
	private TokenSettings tokenSettings;    <13>

	...
```

--------------------------------

### Add OAuth2 Client Dependency (Maven)

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-social-login.adoc

Add the spring-boot-starter-oauth2-client dependency to your Maven project to enable OAuth 2.0 Login support.

```xml
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>
```

--------------------------------

### Add OAuth2 Client Dependency (Gradle)

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-social-login.adoc

Add the spring-boot-starter-oauth2-client dependency to your Gradle project to enable OAuth 2.0 Login support.

```gradle
implementation "org.springframework.boot:spring-boot-starter-oauth2-client"
```

--------------------------------

### Configure GitHub OAuth Client in application.yml

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/samples/README.adoc

Set the spring.security.oauth2.client.registration properties in application.yml to register GitHub as an OAuth client. Replace client-id and client-secret with your actual OAuth 2.0 credentials. Alternatively, set the GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET environment variables.

```yaml
spring:
  security:
    oauth2:
      client:
        registration:	<1>
          github-idp:	<2>
            provider: github
            client-id: github-client-id
            client-secret: github-client-secret
```

--------------------------------

### Configure OAuth2 client registration in Spring Security YAML

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Shows the corresponding Spring Security OAuth2 Client configuration in YAML for the same client 'client-a', including provider issuer-uri and client settings.

```yaml
spring:
  security:
    oauth2:
      client:
        registration:
          client-a:
            provider: spring
            client-id: client-a
            client-secret: secret
            authorization-grant-type: authorization_code
            redirect-uri: "http://127.0.0.1:8080/authorized"
            scope: scope-a
        provider:
          spring:
            issuer-uri: http://localhost:9000
```

--------------------------------

### AuthorizationServerSettingsConfig to Enable Multiple Issuers

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-multitenancy.adoc

Configuration to enable multiple issuers per host. Set to 'true' to allow usage of multiple issuers per host. This is disabled by default.

```java
include::{examples-dir}/main/java/sample/multitenancy/AuthorizationServerSettingsConfig.java[]
```

--------------------------------

### Okta OAuth2 Login Configuration (application.yml)

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-social-login.adoc

YAML configuration for Okta as a social login provider. Uses environment variables OKTA_BASE_URL, OKTA_CLIENT_ID, and OKTA_CLIENT_SECRET for provider URL, client ID, and client secret. The registrationId is 'my-client'.

```yaml
include::{examples-dir}/main/java/sample/sociallogin/application.yml[]
```

--------------------------------

### Client Schema SQL

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-jpa.adoc

SQL DDL for the client table, storing RegisteredClient data with multi-valued fields and settings as comma-separated strings. Uses default column length of 255 except for specified fields.

```sql
CREATE TABLE client (
    id varchar(255) NOT NULL,
    clientId varchar(255) NOT NULL,
    clientIdIssuedAt timestamp DEFAULT CURRENT_TIMESTAMP NOT NULL,
    clientSecret varchar(255) DEFAULT NULL,
    clientSecretExpiresAt timestamp DEFAULT NULL,
    clientName varchar(255) NOT NULL,
    clientAuthenticationMethods varchar(1000) NOT NULL,
    authorizationGrantTypes varchar(1000) NOT NULL,
    redirectUris varchar(1000) DEFAULT NULL,
    postLogoutRedirectUris varchar(1000) DEFAULT NULL,
    scopes varchar(1000) NOT NULL,
    clientSettings varchar(2000) NOT NULL,
    tokenSettings varchar(2000) NOT NULL,
    PRIMARY KEY (id)
);
```

--------------------------------

### Configure OAuth2TokenGenerator via OAuth2AuthorizationServerConfigurer

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/core-model-components.adoc

Shows how to configure the OAuth2TokenGenerator through the OAuth2AuthorizationServerConfigurer within a SecurityFilterChain @Bean. The tokenGenerator variable is assumed to be defined elsewhere.

```java
@Bean
public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
	OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
			OAuth2AuthorizationServerConfigurer.authorizationServer();

	http
		.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())
		.with(authorizationServerConfigurer, (authorizationServer) ->
			authorizationServer
				.tokenGenerator(tokenGenerator)
		)
	    ...

	return http.build();
}
```

--------------------------------

### TenantPerIssuerComponentRegistry

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-multitenancy.adoc

Registry for managing concrete components for each tenant. Contains logic for retrieving a concrete implementation of a particular class using the issuer identifier value. Component registration implicitly enables an allowlist of approved issuers.

```java
include::{examples-dir}/main/java/sample/multitenancy/TenantPerIssuerComponentRegistry.java[]
```

--------------------------------

### CustomCodeGrantAuthenticationProvider.java

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-ext-grant-type.adoc

Sample AuthenticationProvider implementation that validates the authorization grant and issues an access token if valid. It processes CustomCodeGrantAuthenticationToken created by the CustomCodeGrantAuthenticationConverter.

```java
include::{examples-dir}/main/java/sample/extgrant/CustomCodeGrantAuthenticationProvider.java[]
```

--------------------------------

### Configure FederatedIdentityIdTokenCustomizer as a Bean

Source: https://github.com/spring-attic/spring-authorization-server/blob/main/docs/modules/ROOT/pages/guides/how-to-social-login.adoc

Publishes the FederatedIdentityIdTokenCustomizer as a @Bean so Spring Authorization Server uses it to customize the ID token.

```java
@Bean
public OAuth2TokenCustomizer<JwtEncodingContext> idTokenCustomizer() {
    return new FederatedIdentityIdTokenCustomizer();
}
```
Tokens:
Raw