Implementing an OAuth 2 authorization server with Spring Security - the new way! by Laurentiu Spilca

Spring I/O 2022 - Barcelona, 26-27 May
After project Spring Security OAuth has been deprecated, there was a lot of confusion in the community. You could use Spring Security to write the resource server but not the authorization server. But the dark age is now over.
In this session, we discuss implementing an authorization server using the new Spring Security Authorization Server project. spring.io/blog/2021/08/19/spr...
OAuth 2 and OpenID Connect are tremendously important today since they represent the most used standards for implementing authentication in apps. Spring apps are no exception to this approach. We’ll start with a refresher on OAuth 2 and OpenID Connect and remember shortly how an authorization server was configured using the Spring Security OAuth project (now deprecated). Then, we’ll work on an example where we implement an authorization server using the new approach -the Spring Security Authorization Server project. You’ll learn how to use the new project to write your custom authorization server but also what advantages does this project brings above the old-fashioned way.

[@joshzoolian7821]

In looking through dozens of sites advising on this topic, it was super handy hearing him mention deprecated methods and implementations

[@HenrryWith2Rs]

I love this guys channel. He really knows his stuff.

[@adrianstefan1814]

Laur is a great teacher. I learned a lot from him!

[@donnerlucky]

Great Explanation of OAUTH .......

[@Ihavetoreturnsomevideotapes]

Yay Laurentiu !!

[@nico-s29]

Helped me a lot thank you

[@rahmonaliyoqubov]

Hi. Can i use a jjwt implementation instead of nimbous jwt?

[@felipebedoyacastano8434]

Thanks!

[@alxdm9760]

what about if i dont want jwt tokens? just like the old way which is using opaque token, is it possible? especially if the auth server and reaource server are in one project? hope you can have a demo

[@yuyeyang4973]

Does JWT need to be stored on the server?

[@arturolucas776]

amazing

[@farjallahhaythem5675]

the best

[@sergeybayramov1466]

Is it possible and supported in current version to change formLogin to httpBasic?

[@arulmurugansubramaniam8452]

How are you generation code verifier?

[@ngocanha85]

Rename ProviderSettings -> AuthorizationServerSettings

[@gopal2598]

In 0.3.0 version is it supporting password grant ?

[@testingdave7629]

If I am going to user Redis to store token data, how do I create a filter that will fetch the token first on Redis before proceeding with the checking of JWT? I am planning to use Redis as a cache and Postgresql as the DB

[@mayankgupta2543]

Can we have multiple authentication manager configured for different purpose if yes then how?

[@rakeshnukapeyyi5528]

Where is the code challenge being maintained in the spring backend to validate against the code verifier? If it is in memory, it will cause an issue every time the server is restarted. The authenticated public client might use the non-existent code verifier.

[@jofrantoba]

public static void main(String[] args) throws NoSuchAlgorithmException {
SpringApplication.run(Application.class, args);
String codeVerifier=createCodeVerifier();
log.info("code verifier:"+codeVerifier);
log.info("code_challenge:"+createCodeChallenge(codeVerifier));
}

private static String createCodeChallenge(String value) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(value.getBytes(StandardCharsets.US_ASCII));
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}

private static String createCodeVerifier(){
StringKeyGenerator secureKeyGenerator =
new Base64StringKeyGenerator(Base64.getUrlEncoder().withoutPadding(), 96);
return secureKeyGenerator.generateKey();
}

[@mohamedibrahim1836]

how the resource server knows this token is from the authorization server? minute 7:36 the diagram misses this point .

[@yuyeyang4973]

Is this the norm in actual development?

[@nihmathaafiya9693]

I'm a beginner, I'm not really sure as to how that code_challenge was generated, can someone explain it?

[@jofrantoba]

public static void main(String[] args) throws NoSuchAlgorithmException {
SpringApplication.run(Application.class, args);
String codeVerifier=createCodeVerifier();
log.info("code verifier:"+codeVerifier);
log.info("code_challenge:"+createCodeChallenge(codeVerifier));
}

private static String createCodeChallenge(String value) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(value.getBytes(StandardCharsets.US_ASCII));
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}

private static String createCodeVerifier(){
StringKeyGenerator secureKeyGenerator =
new Base64StringKeyGenerator(Base64.getUrlEncoder().withoutPadding(), 96);
return secureKeyGenerator.generateKey();
}

[@ridhopratama9639]

Help. It is statefull, isn't it?? because no sessionCreationPolicy configuration written. like customizer.sessionCreationPolicy(SessionCreationPolicy.STATELESS)

[@AnkitKumar-ow6fg]

I loved the part where he mentioned about Log4J XD

[@csvxmlfan3853]

at the post request i'll always get {"error":"invalid_client"}, stackoverflow and github show solutions but only for version 0.2.. has someone an idea?

[@csvxmlfan3853]

Ahh ok, so of course postman has the role in this example of a public client as such the clientAuthenticationMethod has to be ClientAuthenticationMethod.NONE according to registeredClient documentation... So either Mr. Spilca changed it and did no show it or he used some other trick..

[@victormartin6264]

@@csvxmlfan3853 the trick is the hidden Authorization tab in postman. Try adding --header 'Authorization: Basic Y2xpZW50OnNlY3JldA=='

[@arsenmemetov5794]

@CSVXML FAN, Víctor Martín is right, you have to pass client_id and client_secret using Authorization Header: In Postman's Authorization tab select 'Basic Auth' in 'Type' dropdown menu and then type client_id/client_secret in appeared Username/Password fields.

[@fredzouza]

Please can someone help me with the "code_challenge" i need to generate a SHA256 from any string like "anything" and in "code_verifier" i send "anything" ?

[@jafajarvis324]

same question i have... if you find any solution please let me know

[@jofrantoba]

public static void main(String[] args) throws NoSuchAlgorithmException {
SpringApplication.run(Application.class, args);
String codeVerifier=createCodeVerifier();
log.info("code verifier:"+codeVerifier);
log.info("code_challenge:"+createCodeChallenge(codeVerifier));
}

private static String createCodeChallenge(String value) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(value.getBytes(StandardCharsets.US_ASCII));
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}

private static String createCodeVerifier(){
StringKeyGenerator secureKeyGenerator =
new Base64StringKeyGenerator(Base64.getUrlEncoder().withoutPadding(), 96);
return secureKeyGenerator.generateKey();
}

[@user-uo6zd7oj4v]

I love this presentation! How to get the code and file on your presentation?

[@yuyeyang4973]

Can this example be used in actual development? A friend of mine said that this example has drawbacks. After the server restarts, everyone will be disconnected. Is that true?

[@nick_bezverkhyi]

It can't be used, for the actual development you would probably want to use db instead of in-memory solution

[@nick_bezverkhyi]

@Rendell Jay Eyas no, but should be pretty easy, just read the documentation

[@khajalieubarrie5088]

@Rendell Jay Eyas Check the speakers channel. Has an ongoing playlist on the subject

[@sabbirtanvir177]

why I am getting this error ?
Error creating bean with name 'securityFilterChainAs' defined in class path resource

[@sabbirtanvir177]

it is actually the Noclassdef error for OAuth2AuthorizationServerConfiguration , anyone to help?

[@sabbirtanvir177]

ok, spring changes the version, oauth2-server 0.3.0 will not work with spring 3.0.0, I needed to change ti to 1.0.1 version. I don't know what will spring do tomorrow. :)
Now i follow all steps, but found a response invalid_request. Huuh, i don't know about this error at all.

[@sadiulhakim7814]

I am getting error while using BCryptPasswordEncoder instead of NoOpPasswordEncoder. It says Encoded password does not look like BCrypt.

[@xxxHipHopRap]

Did u fix it? I have the same problem but I want to use BCryptPasswordEncoder

[@sadiulhakim7814]

@@xxxHipHopRap no

[@xxxHipHopRap]

@@sadiulhakim7814 I fixed it doing this if u still need it:
@Bean
public RegisteredClientRepository registeredClientRepository() {
BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
RegisteredClient r1 = RegisteredClient.withId(UUID.randomUUID().toString())
.clientId("myclient")
.clientSecret(passwordEncoder.encode("secret"))........

[@jafajarvis324]

can anyone tell me how can i generate my own code chanllenge

[@jafajarvis324]

I got answer. Its totally pkce. We can get it from online and generate our own pkce code

[@nihmathaafiya9693]

@@jafajarvis324 Hey, could you clarify how? It'll be really helpful, thanks

[@jofrantoba]

public static void main(String[] args) throws NoSuchAlgorithmException {
SpringApplication.run(Application.class, args);
String codeVerifier=createCodeVerifier();
log.info("code verifier:"+codeVerifier);
log.info("code_challenge:"+createCodeChallenge(codeVerifier));
}

private static String createCodeChallenge(String value) throws NoSuchAlgorithmException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(value.getBytes(StandardCharsets.US_ASCII));
return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
}

private static String createCodeVerifier(){
StringKeyGenerator secureKeyGenerator =
new Base64StringKeyGenerator(Base64.getUrlEncoder().withoutPadding(), 96);
return secureKeyGenerator.generateKey();
}

[@dawidd6356]

Dude speaks like a MACHINE (nvm i had it on 1.25x)

[@parisanangangom2300]

🤣🤣

[@mukendiemmanuel5640]

i do the same configuration but when i try to get access token on /oauth2/token it return 404 not found exception

[@kiranjawale8822]

Your issue resolved ?

[@mukendiemmanuel5640]

@@kiranjawale8822 yes the problem was in query params and the Authorization header