SpringOne 2020 Explain it to Me Like I’m 5: Oauth2 and OpenID Daniel Mikusa, Senior Staff Technical Support Engineer at VMware

1. │

2. │

3. │

4. │
●
‐
‐
‐
‐
‐
‐
●
●
‐
‐
‐
‐
‐
‐
●

5. │
●
●
●
●
●
●
●
●
●
●

6. │
●
●
●
●
●
●
●

7. │
●
●
●
●
●

8. │

9. │

10. │

11. │
‐
‐
‐
‐

12. │

13. │
●
●
●
OAuth2 Role Scopes
Client / Application serve.lunch, eat.lunch
Authorization Server (user’s record) cook.lunch, eat.lunch
User Login Form / Approval eat.lunch
Result: eat.lunch ��

14. │

15. │
●
●
●
●
●
●
●
●

16. │
●
●
●
●
●
●
●

17. │
●
●
●
●
●
●
●
●
●

18. │
●
●
○
○
○
○
○
●

19. │
●
●
●
‐
‐
●
●
●

20. │

21. │
●
●
●
●

22. │
{baseUrl}/login/oauth2/code/{registrationId}
application.properties application.yaml
a. spring.security.oauth2.client.registration.{registrationId}.client-id=my-client-id
b. spring.security.oauth2.client.registration.{registrationId}.client-secret=my-client-secret
c. spring.security.oauth2.client.registration.{registrationId}.issuer-uri= https://my-provider/
..
./mvnw spring-boot:run

23. │
org.springframework:spring-webflux
io.projectreactor.netty:reactor-netty
http.oauth2Client(withDefaults())

24. │
application.properties application.yaml
a. spring.security.oauth2.resourceserver.jwt.issuer-uri={auth-provider}/.well-known/jwks.json
http.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt);
antMatchers(HttpMethod.GET,
"/message/**").hasAuthority("SCOPE_message:read")
./mvnw spring-boot:run

25. │
logging.level.org.springframework.security=debug
--debug=true debug=true application.properties
/beans /configprops

26. │
●
●
●

27. │
●
●
●
●
‐
‐
●
‐
‐
‐

28. │