Spring Security in Action, Second Edition

14 Implementing an OAuth 2 authorization server

This chapter covers

• Implementing a Spring Security OAuth 2 authorization server
• Using the authorization code and client credentials grant types
• Configuring opaque and non-opaque access tokens
• Using token revocation and introspection

Chapter 13 covered OAuth 2 and OpenID Connect. We discussed the actors that play a role in a system where the authentication and authorization are based on the OAuth 2 specification. The authorization server was one of these actors. Its role is to authenticate a user and the app they use (the client), as well as issue tokens that serve as proof of authentication to access resources protected by a backend. Sometimes, the client does that on behalf of a user.

The Spring ...