Getting Started with Spring Authorization Server

The Spring Authorization Server project provides support for OAuth 2.1 Authorization Framework, OpenID Connect Core 1.0, and the numerous extension specifications.
The primary goal of this talk is to demonstrate how to securely configure a Spring Authorization Server deployment using identified trust boundaries. The IETF draft, OAuth 2.0 Security Best Current Practice, will be referenced and recommendations will be provided for preventing attacks and implementing mitigations using defensive, in-depth strategies.
The following will be discussed and demonstrated:
- Current features
- Starting up with default configuration
- Customizing the configuration
- Adding custom features via extension
- Feature roadmap
Joe Grandja, Spring Security Engineer at VMware
Steve Riesenberg, Software Engineer at VMware
Slides: www.slideshare.net/Pivotal/ge...

[@zeratultarsonis9630]

nice, waiting for the full OIDC implementation. :)

[@michaeldeng1981]

Finally, Authorization Server. Thank you

[@erickloningo2252]

Awesome presentation, leant alot.

[@raydeng83]

This is awesome!

[@phamduyphuong7907]

Thank you for your presentation. Can you show a details version about UserDetailsService implemetation with database authentication instead of in memory. Thanks

[@arminghavidel7684]

Thank you for your presentation. Where can I find the hones-client and evil-client examples?

[@lucaleonardoscorcia2716]

Nice video showcase! I was wondering two things: 1) how should one customize the credentials or consent screen? 2) what if I want to delegate user authentication to another method beyond user/password (say, X509 cert or SAML or even another OIDC identity provider like Google Auth, behaving somewhat like an authentication proxy)?

[@sahariaralamkhandoker3178]

Could you please share the codes?

[@javaspace]

Hello sir.
I have this scenario.
ServiceA that provides an angular app with data and ServiceA needs to be protected. That is fine, I made it a resource server, and had a separate auth server to handle authentication. But now, ServiceA additionally call another protected ServiceB and ServiceC. ServiceB & ServiceC both have their own separate authentication as they are different external companies. ServiceB & ServiceC are both a resource and an auth server which I heard there is nothing wrong with that setup. Now, given that ServiceA as a resource server needs to be a client and call another protected service itself, is there support for a service to be both resource and client at the same time? How do I handle this scenario
I notice that once I add a dependency for oauth2-client, in the resource-server with appropriate configs, I always get a message acess denied ,Login with OAuth 2.0, when i try to access any endpoint of the resource server.
Even after I authorised and got an access token.

[@pradeepns9052]

Hi..
Looking for suggestions on implementing security on spring-boot microservices integrated with angular UI. I have an external identity provider(Ping Federate) to support SSO and all user roles/authorities are maintained in the application database.
What is the best approach to secure APIs? If Oauth is recommended way, how to implement it(Stateless).
Should the Authorization Server be customized to connect to the
identity provider Authorization Server and generate tokens from the custom Authorization Server?
or
Oauth2 client should generate tokens by loading user details from the database after successful authentication with the identity provider?

[@tosandeepyandra]

Please do share the code examples

[@Bifonic]

Won't there any problem to have an authorization-server and a resource-server in the same application?

[@kmukthi1]

Could you please post the links to the code samples used in the video ? Thanks

[@mwzenas]

Yes, this will be very good for us

[@vukkumsp]

Why endpoints like /authorize ... are kept in Client part of project. /authorize endpoint should be part of Authorization Server right ? Am I missing something here ?

[@gustavodesouzalemos8426]

Oh, that "/authorize" has nothing to do with authorization's server endpoint whose by default is "/oauth2/authorize". The first endpoint could be anything else and they showed that you can customize the latter one by the exposed ProviderSettings bean

[@Jawwad124]

There is almost no information on how to get started, should have a separate sessions on attacks and all.