1. Getting Started with
Spring Authorization Server
Joe Grandja
@joe_grandja
Steve Riesenberg
@sjohnr

2. Security Standards
● OAuth 2.1 Authorization Framework
● OAuth 2.0 Token Revocation
● OAuth 2.0 Token Introspection
● JSON Web Token (JWT)
● JSON Web Key (JWK)
● JSON Web Signature (JWS)
● OpenID Connect Core 1.0
● OpenID Connect Discovery 1.0
● OpenID Connect Dynamic Client Registration 1.0

3. Core Components / Default Configuration
● RegisteredClientRepository / RegisteredClient
● OAuth2AuthorizationService / OAuth2Authorization
● OAuth2AuthorizationConsentService / OAuth2AuthorizationConsent
● JWKSource<SecurityContext> (Nimbus API)
● ProviderSettings
● OAuth2AuthorizationServerConfiguration /
OAuth2AuthorizationServerConfigurer

4. Customizing Authorization
● Authorization Endpoint
● Insufficient Redirect URI Validation
● Mix-Up
● Authorization Code Injection

5. Customizing Client Authentication
● Mutual-TLS Client Authentication
● Client Certificate-Bound Access Tokens
● Token Replay Prevention

6. PKI Hierarchy
CN=spring-root-ca
CN=spring-client
CN=spring-authorization-server
CN=spring-resource-server

7. Roadmap
● OpenID Connect Core 1.0
● JSON Web Token (JWT) Profile for OAuth 2.0 Client
Authentication
● OAuth 2.0 Mutual-TLS Client Authentication and
Certificate-Bound Access Tokens
● Resource Indicators for OAuth 2.0

8. Thank you!
● Spring Authorization Server
○ https://github.com/spring-projects/spring-authorization-server
● Sample branches
○ https://github.com/jgrandja/spring-authorization-server/tree/springone-2021
○ https://github.com/sjohnr/spring-authorization-server/tree/springone-2021
Joe Grandja
@joe_grandja
Steve Riesenberg
@sjohnr