Overview :: Spring Authorization Server
Why Spring
Overview
Trending
Generative AI
Cloud
Architecture Patterns
Microservices
Reactive
Event Driven
Application Types
Web Applications
Serverless
Batch
Learn
Getting Started
Quickstart
Guides
Academy
Courses
Get Certified
Projects
Overview
Projects
Spring Boot
Spring Framework
Spring Cloud
Spring AI
Spring Data
Spring Integration
Spring Batch
Spring Security
Foundational Projects
Micrometer
Reactor
Development Tools
Spring Tools
Spring Initializr
Resources
Blog
Release Calendar
Version Mappings
Release Highlights
Security Advisories
GitHub Orgs
Spring Projects
Spring Cloud
Community
Overview
Events
Authors
Enterprise
Overview
Long-term Support
Automated Upgrades
Governance and Compliance
Modern App Development
light
Spring Authorization Server
1.5.8
Search
Overview
Getting Help
Getting Started
Javadoc
Configuration Model
Core Model / Components
Protocol Endpoints
How-to Guides
How-to: Authenticate using a Single Page Application with PKCE
How-to: Authenticate using Social Login
How-to: Implement an Extension Authorization Grant Type
How-to: Implement Multitenancy
How-to: Customize the OpenID Connect 1.0 UserInfo response
How-to: Implement core services with JPA
How-to: Implement core services with Redis
How-to: Add authorities as custom claims in JWT access tokens
How-to: Register a client dynamically
Search
Edit this Page
GitHub Project
Stack Overflow
Spring Authorization Server
Overview
Overview
This site contains reference documentation and how-to guides for Spring Authorization Server.
Introducing Spring Authorization Server
Spring Authorization Server is a framework that provides implementations of the OAuth 2.1 and OpenID Connect 1.0 specifications and other related specifications.
It is built on top of Spring Security to provide a secure, light-weight, and customizable foundation for building OpenID Connect 1.0 Identity Providers and OAuth2 Authorization Server products.
Use Cases
The following list provides some use cases for using Spring Authorization Server compared to using an open source or commercial OAuth2 or OpenID Connect 1.0 Provider product.
Provides full control of configuration and customization when advanced customization scenarios are required.
Preference for a light-weight authorization server compared to a commercial product that includes all the "bells and whistles".
Potential savings in software licensing and/or hosting costs.
Quick startup and ease of use during development using the familiar Spring programming model.
Feature List
Spring Authorization Server supports the following features:
Category
Feature
Related specifications
Authorization Grant
Authorization Code
User Consent
Client Credentials
Refresh Token
Device Code
User Consent
Token Exchange
The OAuth 2.1 Authorization Framework (draft)
Authorization Code Grant
Client Credentials Grant
Refresh Token Grant
OpenID Connect Core 1.0 (spec)
Authorization Code Flow
OAuth 2.0 Device Authorization Grant
(spec)
Device Flow
OAuth 2.0 Token Exchange (spec)
Token Exchange Flow
Token Formats
Self-contained (JWT)
Reference (Opaque)
JSON Web Token (JWT) (RFC 7519)
JSON Web Signature (JWS) (RFC 7515)
Token Types
DPoP-bound Access Tokens
OAuth 2.0 Demonstrating Proof of Possession (DPoP) (RFC 9449)
Client Authentication
client_secret_basic
client_secret_post
client_secret_jwt
private_key_jwt
tls_client_auth
self_signed_tls_client_auth
none (public clients)
The OAuth 2.1 Authorization Framework (Client Authentication)
JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication (RFC 7523)
OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (RFC 8705)
Proof Key for Code Exchange by OAuth Public Clients (PKCE) (RFC 7636)
Protocol Endpoints
OAuth2 Authorization Endpoint
OAuth2 Pushed Authorization Request Endpoint
OAuth2 Device Authorization Endpoint
OAuth2 Device Verification Endpoint
OAuth2 Token Endpoint
OAuth2 Token Introspection Endpoint
OAuth2 Token Revocation Endpoint
OAuth2 Authorization Server Metadata Endpoint
JWK Set Endpoint
OpenID Connect 1.0 Provider Configuration Endpoint
OpenID Connect 1.0 Logout Endpoint
OpenID Connect 1.0 UserInfo Endpoint
OpenID Connect 1.0 Client Registration Endpoint
The OAuth 2.1 Authorization Framework (draft)
Authorization Endpoint
Token Endpoint
OAuth 2.0 Pushed Authorization Requests (RFC 9126)
Pushed Authorization Request Endpoint
OAuth 2.0 Device Authorization Grant (RFC 8628)
Device Authorization Endpoint
Device Verification Endpoint
OAuth 2.0 Token Introspection (RFC 7662)
OAuth 2.0 Token Revocation (RFC 7009)
OAuth 2.0 Authorization Server Metadata (RFC 8414)
JSON Web Key (JWK) (RFC 7517)
OpenID Connect Discovery 1.0 (spec)
Provider Configuration Endpoint
OpenID Connect RP-Initiated Logout 1.0 (spec)
Logout Endpoint
OpenID Connect Core 1.0 (spec)
UserInfo Endpoint
OpenID Connect Dynamic Client Registration 1.0 (spec)
Client Registration Endpoint
Client Configuration Endpoint
Spring Authorization Server
Getting Help
Spring Authorization Server
Stable
1.5.8
1.4.8
1.3.7
1.2.7
Preview
2.0.0-M2
Snapshot
2.0.0-SNAPSHOT
1.5.9-SNAPSHOT
1.4.9-SNAPSHOT
1.3.8-SNAPSHOT
1.2.8-SNAPSHOT
Related Spring Documentation
Spring Framework
Spring Security
Spring Authorization Server
Spring LDAP
Spring Security Kerberos
Spring Session
Spring Vault
All Docs...
Copyright © 2005 -
Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
Terms of Use • Privacy • Trademark Guidelines • Thank you • Your California Privacy Rights • Cookie Settings
Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra™, and Apache Geode™ are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Java™, Java™ SE, Java™ EE, and OpenJDK™ are trademarks of Oracle and/or its affiliates. Kubernetes® is a registered trademark of the Linux Foundation in the United States and other countries. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Windows® and Microsoft® Azure are registered trademarks of Microsoft Corporation. “AWS” and “Amazon Web Services” are trademarks or registered trademarks of Amazon.com Inc. or its affiliates. All other trademarks and copyrights are property of their respective owners and are only mentioned for informative purposes. Other names may be trademarks of their respective owners.
Search in all Spring Docs