This document outlines the essentials of getting started with the Spring Authorization Server, detailing various security standards like OAuth 2.1 and OpenID Connect. It describes core components, default configurations, and methods for customizing both authorization and client authentication. Additionally, it includes links to sample branches and a roadmap for future developments.

1. Getting Started with
Spring Authorization Server
Joe Grandja
@joe_grandja
Steve Riesenberg
@sjohnr

2. Security Standards
● OAuth 2.1 Authorization Framework
● OAuth 2.0 Token Revocation
● OAuth 2.0 Token Introspection
● JSON Web Token (JWT)
● JSON Web Key (JWK)
● JSON Web Signature (JWS)
● OpenID Connect Core 1.0
● OpenID Connect Discovery 1.0
● OpenID Connect Dynamic Client Registration 1.0

3. Core Components / Default Configuration
● RegisteredClientRepository / RegisteredClient
● OAuth2AuthorizationService / OAuth2Authorization
● OAuth2AuthorizationConsentService / OAuth2AuthorizationConsent
● JWKSource<SecurityContext> (Nimbus API)
● ProviderSettings
● OAuth2AuthorizationServerConfiguration /
OAuth2AuthorizationServerConfigurer

4. Customizing Authorization
● Authorization Endpoint
● Insufficient Redirect URI Validation
● Mix-Up
● Authorization Code Injection

5. Customizing Client Authentication
● Mutual-TLS Client Authentication
● Client Certificate-Bound Access Tokens
● Token Replay Prevention

6. PKI Hierarchy
CN=spring-root-ca
CN=spring-client
CN=spring-authorization-server
CN=spring-resource-server

7. Roadmap
● OpenID Connect Core 1.0
● JSON Web Token (JWT) Profile for OAuth 2.0 Client
Authentication
● OAuth 2.0 Mutual-TLS Client Authentication and
Certificate-Bound Access Tokens
● Resource Indicators for OAuth 2.0

8. Thank you!
● Spring Authorization Server
○ https://github.com/spring-projects/spring-authorization-server
● Sample branches
○ https://github.com/jgrandja/spring-authorization-server/tree/springone-2021
○ https://github.com/sjohnr/spring-authorization-server/tree/springone-2021
Joe Grandja
@joe_grandja
Steve Riesenberg
@sjohnr