OAuth 2

by

In this blog post, you will learn how to add user Roles and Authorities to a JWT token issued by the new Spring Authorization Server. When writing this tutorial, I assumed you are familiar with the new Spring Configuration Server setup. Otherwise, please check the Spring Authorization Server tutorial first. Adding Granted Authorities to JWT To include…

Read More Add Roles to JWT Issued by Spring Authorization Server
by 0 comments on "Amazon Cognito User Authentication in Spring Boot REST"

In the previous tutorial, we learned that how we can do User Authentication with Amazon Cognito in Spring Boot Application. In this tutorial, we will take our previous learnings and continue with the following. Create Rest Controller to handle /login HTTP POST requests. Read username and password from the request body to authenticate with Amazon Cognito…

Read More Amazon Cognito User Authentication in Spring Boot REST
by 0 comments on "User Authentication with Amazon Cognito in Spring Boot Application"

In this article, we will learn how we can do User Authentication with Amazon Cognito in Spring Boot Application. But before that, let’s see what Amazon Cognito is. According to what’s mentioned on the AWS official website. Amazon Cognito lets you add user sign-up, sign-in, and access control to your web and mobile apps quickly…

Read More User Authentication with Amazon Cognito in Spring Boot Application
by 0 comments on "The New OAuth2 Authorization Server"

In this tutorial, I’ll guide you on how to use the new OAuth2 Authorization Server(v0.0.3) built by the Spring Team. Below are the new features that have been introduced in the newer version: Enforce one-time use for authorization code Introduce OAuth2 Tokens Add Refresh Token grant Implement Token Revocation Endpoint OAuth2 is an authorization method…

Read More The New OAuth2 Authorization Server
by 0 comments on "Spring Security OAuth 2 Social Logout"

In this short tutorial, you will learn how to configure the /logout functionality in your Spring Boot Web application that uses OAuth2 Social Login. To learn how to implement the OAuth2 Social login feature, please check the following tutorial: Spring Security OAuth 2 Social Login. Configure HttpSecurity Applications that use Spring Security and OAuth2 Social login…

Read More Spring Security OAuth 2 Social Logout
by 0 comments on "Spring Security OAuth 2 Social Login"

In this tutorial, you will learn how to add a Social Login(OAuth 2) feature into your Spring MVC Web application. This will allow users to login to your application with their social network accounts like Facebook, Google, or other large services that support OAuth 2 like for example GitHub. Spring Security 5 offers very good…

Read More Spring Security OAuth 2 Social Login
by 0 comments on "OAuth 2.0 Refresh Token Example"

In this tutorial, you will learn how to refresh OAuth 2.0 access token using the Refresh Token OAuth 2.0 Grant Type. To learn how to use other OAuth 2.0 grant types, please check out the following tutorials: Client Credentials Grant Type with Keycloak, OAuth 2.0 Device Authorization Grant example, PKCE Verification in Authorization Code Grant,…

Read More OAuth 2.0 Refresh Token Example
by 0 comments on "Keycloak: Client Credentials Grant Example"

In this tutorial, you will learn how to register a new OAuth Client application with Keycloak and how to request an access token using the Client Credentials grant type. If you are interested to learn how to perform other OAuth 2 authorization flows with Keycloak, then have a look at the following tutorials as well.…

Read More Keycloak: Client Credentials Grant Example
by 0 comments on "OAuth 2.0 Device Authorization Grant Flow Example"

The Oauth 2 Device Authorization Grant, also formerly known as the Device Flow, is an Oauth 2 extension that enables devices with no browser or limited input capability to obtain an access token. You might have experienced the Device flow when authorizing a PlayStation or a TV app to access your Microsoft or Google account.…

Read More OAuth 2.0 Device Authorization Grant Flow Example
by 0 comments on "PKCE Code Verifier and Code Challenge in Java"

In this tutorial, you will learn how to generate the OAuth PKCE Code Verifier and the Code Challenge in Java. The Code Verifier and the Code Challenge are used in the OAuth PKCE-enhanced Authorization Code Grant flow and the specs on how these two should be generated can be found here RFC7636. To learn how…

Read More PKCE Code Verifier and Code Challenge in Java
by 1 comment on "PKCE Verification in Authorization Code Grant"

In this tutorial, you will learn how to perform PKCE verification when acquiring an access token using the OAuth 2 Authorization Code Grant flow. PKCE stands for Proof Key for Code Exchange and the PKCE-enhanced Authorization Code Flow builds upon the standard Authorization Code Flow, so the steps are very similar. To learn how to acquire…

Read More PKCE Verification in Authorization Code Grant
by 0 comments on "OAuth 2 Implicit Grant Type Flow Example"

In this tutorial, you will learn how to use an OAuth 2 Implicit Grant Type authorization flow to acquire an access token from an authorization server. The Implicit Grant Type was previously recommended for native apps and JavaScript apps where the access token was returned immediately without an extra authorization code exchange step. When following…

Read More OAuth 2 Implicit Grant Type Flow Example