Hands-On Spring Security 5 for Reactive Applications

Authorization server

This is the server that authenticates and authorizes client applications to access the secured resources owned by the resource owner and on the resource server. It is not uncommon to see the same server performing both roles.

To participate in OAuth, your application has to first register with the service provider (Google , Facebook, and so on) against which you plan to authenticate by providing the application name, application URL, and callback URL. Successful registration of your application with the service provider gives you two values unique to your application: client application_id and client_secret. client_id can be exposed publicly but client_secret is kept hidden (private). Both these values are needed whenever ...