OAuth 2.1 Authorization Server :: Spring Security
Why Spring
Overview
Trending
Generative AI
Cloud
Architecture Patterns
Microservices
Reactive
Event Driven
Application Types
Web Applications
Serverless
Batch
Learn
Getting Started
Quickstart
Guides
Academy
Courses
Get Certified
Projects
Overview
Projects
Spring Boot
Spring Framework
Spring Cloud
Spring AI
Spring Data
Spring Integration
Spring Batch
Spring Security
Foundational Projects
Micrometer
Reactor
Development Tools
Spring Tools
Spring Initializr
Resources
Blog
Release Calendar
Version Mappings
Release Highlights
Security Advisories
GitHub Orgs
Spring Projects
Spring Cloud
Community
Overview
Events
Authors
Enterprise
Overview
Long-term Support
Automated Upgrades
Governance and Compliance
Modern App Development
light
Spring Security
7.0.6
Search
Overview
Prerequisites
Community
What’s New
Preparing for 8.0
Migrating to 7
Servlet
Authorization
OAuth 2.0
SAML 2.0
Reactive
Getting Spring Security
Javadoc
Features
Authentication
Password Storage
Authorization
Protection Against Exploits
CSRF
HTTP Headers
HTTP Requests
Integrations
REST Client
HTTP Service Clients
Cryptography
Spring Data
Java’s Concurrency APIs
Jackson
Localization
Project Modules
Samples
Servlet Applications
Getting Started
Architecture
Authentication
Authentication Architecture
Username/Password
Reading Username/Password
Form
Basic
Digest
Password Storage
In Memory
JDBC
UserDetails
CredentialsContainer
Password Erasure
UserDetailsService
PasswordEncoder
DaoAuthenticationProvider
LDAP
Multi-Factor Authentication
Persistence
Passkeys
One-Time Token
Session Management
Remember Me
Anonymous
Pre-Authentication
JAAS
CAS
X509
Run-As
Logout
Authentication Events
Kerberos
Introduction
Reference
Samples
Appendices
Authorization
Authorization Architecture
Authorize HTTP Requests
Method Security
Domain Object Security ACLs
Authorization Events
OAuth2
OAuth2 Log In
Core Configuration
Advanced Configuration
OIDC Logout
OAuth2 Client
Core Interfaces and Classes
OAuth2 Authorization Grants
OAuth2 Client Authentication
OAuth2 Authorized Clients
OAuth2 Resource Server
JWT
Opaque Token
Multitenancy
Bearer Tokens
DPoP-bound Access Tokens
Protected Resource Metadata
OAuth2 Authorization Server
Getting Started
Configuration Model
Core Model / Components
Protocol Endpoints
SAML2
SAML2 Log In
SAML2 Log In Overview
SAML2 Authentication Requests
SAML2 Authentication Responses
SAML2 Logout
SAML2 Metadata
Migrating from Spring Security SAML Extension
Protection Against Exploits
Cross Site Request Forgery (CSRF)
Security HTTP Response Headers
HTTP
HttpFirewall
Integrations
Concurrency
Localization
Servlet APIs
Spring Data
Spring MVC
WebSocket
Spring’s CORS Support
JSP Taglib
Observability
Configuration
Java Configuration
Kotlin Configuration
Namespace Configuration
Testing
Method Security
MockMvc Support
MockMvc Setup
Security RequestPostProcessors
Mocking Users
Mocking CSRF
Mocking Form Login
Mocking HTTP Basic
Mocking OAuth2
Mocking Logout
Security RequestBuilders
Security ResultMatchers
Security ResultHandlers
Appendix
Database Schemas
XML Namespace
Authentication Services
Web Security
Method Security
LDAP Security
WebSocket Security
Proxy Server Configuration
FAQ
Reactive Applications
Getting Started
Authentication
X.509 Authentication
Logout
Session Management
Concurrent Sessions Control
Authorization
Authorize HTTP Requests
EnableReactiveMethodSecurity
OAuth2
OAuth2 Log In
Core Configuration
Advanced Configuration
OIDC Logout
OAuth2 Client
Core Interfaces and Classes
OAuth2 Authorization Grants
OAuth2 Client Authentication
OAuth2 Authorized Clients
OAuth2 Resource Server
JWT
Opaque Token
Multitenancy
Bearer Tokens
Protection Against Exploits
CSRF
Headers
HTTP Requests
ServerWebExchangeFirewall
Integrations
CORS
RSocket
Observability
Testing
Testing Method Security
Testing Web Security
WebTestClient Setup
Testing Authentication
Testing CSRF
Testing OAuth 2.0
Testing X509
WebFlux Security
GraalVM Native Image Support
Method Security
Search
Edit this Page
GitHub Project
Stack Overflow
Spring Security
Servlet Applications
OAuth2
OAuth2 Authorization Server
For the latest stable version, please use Spring Security 7.1.0!
OAuth 2.1 Authorization Server
The OAuth 2.1 Authorization Server features provide support for the Authorization Server role as defined in the OAuth 2.1 Authorization Framework.
The Authorization Server features provide implementations of the OAuth 2.1 and OpenID Connect 1.0 specifications and other related specifications.
It provides a secure, light-weight, and customizable foundation for building OpenID Connect 1.0 Identity Providers and OAuth 2.1 Authorization Server products.
Use Cases
The following list provides some use cases for using Spring Security Authorization Server compared to using an open source or commercial OAuth2 or OpenID Connect 1.0 Provider product.
Provides full control of configuration and customization when advanced customization scenarios are required.
Preference for a light-weight authorization server compared to a commercial product that includes all the "bells and whistles".
Potential savings in software licensing and/or hosting costs.
Quick startup and ease of use during development using the familiar Spring programming model.
Feature List
Spring Security Authorization Server supports the following features:
Category
Feature
Related specifications
Authorization Grant
Authorization Code
User Consent
Client Credentials
Refresh Token
Device Code
User Consent
Token Exchange
The OAuth 2.1 Authorization Framework (draft)
Authorization Code Grant
Client Credentials Grant
Refresh Token Grant
OpenID Connect Core 1.0 (spec)
Authorization Code Flow
OAuth 2.0 Device Authorization Grant
(spec)
Device Flow
OAuth 2.0 Token Exchange (spec)
Token Exchange Flow
Token Formats
Self-contained (JWT)
Reference (Opaque)
JSON Web Token (JWT) (RFC 7519)
JSON Web Signature (JWS) (RFC 7515)
Token Types
DPoP-bound Access Tokens
OAuth 2.0 Demonstrating Proof of Possession (DPoP) (RFC 9449)
Client Authentication
client_secret_basic
client_secret_post
client_secret_jwt
private_key_jwt
tls_client_auth
self_signed_tls_client_auth
none (public clients)
The OAuth 2.1 Authorization Framework (Client Authentication)
JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication (RFC 7523)
OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (RFC 8705)
Proof Key for Code Exchange by OAuth Public Clients (PKCE) (RFC 7636)
Protocol Endpoints
OAuth2 Authorization Endpoint
OAuth2 Pushed Authorization Request Endpoint
OAuth2 Device Authorization Endpoint
OAuth2 Device Verification Endpoint
OAuth2 Token Endpoint
OAuth2 Token Introspection Endpoint
OAuth2 Token Revocation Endpoint
OAuth2 Client Registration Endpoint
OAuth2 Authorization Server Metadata Endpoint
JWK Set Endpoint
OpenID Connect 1.0 Provider Configuration Endpoint
OpenID Connect 1.0 Logout Endpoint
OpenID Connect 1.0 UserInfo Endpoint
OpenID Connect 1.0 Client Registration Endpoint
The OAuth 2.1 Authorization Framework (draft)
Authorization Endpoint
Token Endpoint
OAuth 2.0 Pushed Authorization Requests (RFC 9126)
Pushed Authorization Request Endpoint
OAuth 2.0 Device Authorization Grant (RFC 8628)
Device Authorization Endpoint
Device Verification Endpoint
OAuth 2.0 Token Introspection (RFC 7662)
OAuth 2.0 Token Revocation (RFC 7009)
OAuth 2.0 Dynamic Client Registration Protocol (RFC 7591)
OAuth 2.0 Authorization Server Metadata (RFC 8414)
JSON Web Key (JWK) (RFC 7517)
OpenID Connect Discovery 1.0 (spec)
Provider Configuration Endpoint
OpenID Connect RP-Initiated Logout 1.0 (spec)
Logout Endpoint
OpenID Connect Core 1.0 (spec)
UserInfo Endpoint
OpenID Connect Dynamic Client Registration 1.0 (spec)
Client Registration Endpoint
Client Configuration Endpoint
Section Summary
Getting Started
Configuration Model
Core Model / Components
Protocol Endpoints
Spring Security
Stable
7.1.0
7.0.6
6.5.11
Snapshot
7.1.1-SNAPSHOT
7.0.7-SNAPSHOT
6.5.12-SNAPSHOT
Related Spring Documentation
Spring Framework
Spring Security
Spring Authorization Server
Spring LDAP
Spring Security Kerberos
Spring Session
Spring Vault
Spring GraphQL
All Docs...
Copyright © 2005 -
Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
Terms of Use • Privacy • Trademark Guidelines • Thank you • Your California Privacy Rights • Cookie Settings
Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra™, and Apache Geode™ are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Java™, Java™ SE, Java™ EE, and OpenJDK™ are trademarks of Oracle and/or its affiliates. Kubernetes® is a registered trademark of the Linux Foundation in the United States and other countries. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Windows® and Microsoft® Azure are registered trademarks of Microsoft Corporation. “AWS” and “Amazon Web Services” are trademarks or registered trademarks of Amazon.com Inc. or its affiliates. All other trademarks and copyrights are property of their respective owners and are only mentioned for informative purposes. Other names may be trademarks of their respective owners.
Search in all Spring Docs