Code with Spring Security OAuth2

The name of feature image is Peacock Girl, and Story of the painter

IETF OAuth specs

These are specs about OAuth from IETF. There is a new draft about OAuth 2.1 already.

• IETF - search results OAuth
• rfc5849: The OAuth 1.0 Protocol
• rfc6749: The OAuth 2.0 Authorization Framework
  • rfc8252: OAuth 2.0 for Native Apps
  • rfc6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
  • rfc8996: Deprecating TLS 1.0 and TLS 1.1
• draft: The OAuth 2.1 Authorization Framework

OAuth framework

This is a very handy website, trying to gather all the resources regarding of OAuth. It’s definitely worth checking it out.

• OAuth 2.0

Spring Security - OAuth support

Before I found below page, I was so struggling figure out what to use.

• Spring OAuth2 Features Matrix

There is an old OAuth 1.0 and 2.0 support from Spring Security SubProject, and it’s deprecated now. And a new OAuth support living in Spring Security main project rather than a sub.

Look careful at the group and artifact id, don’t get confused when you search online for any supporting:

• Old one -> org.springframework.security.oauth: spring-security-oauth2
• New one -> org.springframework.security: spring-security-oauth2-core

1. Deprecated spring-security-oauth project

• version: 2.5.1.RELEASE
• Spring.io: spring-security-oauth
• GitHub: spring-security-oauth
• MavenRepo: spring-security-oauth

  org.springframework.security.oauth:spring-security-oauth2:2.5.1.RELEASE
    org.springframework.security:spring-security-core:4.2.20.RELEASE
    org.springframework.security:spring-security-config:4.2.20.RELEASE
    org.springframework.security:spring-security-web:4.2.20.RELEASE
    org.springframework:spring-core:4.3.30.RELEASE
  

2. Interim transition OAuth2 Boot project, using deprecated spring-security-oauth2

• version: 2.5.2
• Spring.io: spring-security-oauth2-boot
• GitHub: spring-security-oauth2-boot
• MavenRepo: spring-security-oauth2-boot

  org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure:2.5.2
    org.springframework.security.oauth:spring-security-oauth2:2.5.1.RELEASE
    org.springframework.security:spring-security-jwt:1.1.1.RELEASE
    org.springframework.boot:spring-boot:2.5.2
    org.springframework.boot:spring-boot-autoconfigure:2.5.2
  

3. New Spring Security spring-security-oauth2-*

• Spring.io: spring-security
• GitHub: spring-security

3.1 spring-security-oauth2-authorization-server

• version: 0.2.0
• Spring.io: spring-security-oauth2-authorization-server
• GitHub: spring-security-oauth2-authorization-server
• MavenRepo: spring-security-oauth2-authorization-server

  org.springframework.security:spring-security-oauth2-authorization-server:0.2.0
    org.springframework.security:spring-security-config:5.5.2
    org.springframework.security:spring-security-oauth2-core:5.5.2
    org.springframework.security:spring-security-oauth2-jose:5.5.2
    org.springframework.security:spring-security-oauth2-resource-server:5.5.2
    org.springframework.security:spring-security-web:5.5.2
  	
    org.springframework:spring-core:5.3.9
    com.nimbusds:nimbus-jose-jwt:9.10.1
    com.fasterxml.jackson.core:jackson-databind:2.12.4
    com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.12.4
  

3.2 spring-security-oauth2-client

• version: 5.5.2
• Spring.io: spring-security-oauth2-client
• GitHub: spring-security-oauth2-client
• MavenRepo: spring-security-oauth2-client

  org.springframework.security:spring-security-oauth2-client:5.5.2
    org.springframework.security:spring-security-core:5.5.2
    org.springframework.security:spring-security-oauth2-core:5.5.2
    org.springframework.security:spring-security-web:5.5.2
  	
    org.springframework:spring-core:5.3.9
    com.nimbusds:oauth2-oidc-sdk:9.15
  

3.3 spring-security-oauth2-resource-server

• version: 5.5.2
• Spring.io: spring-security-oauth2-resource-server
• GitHub: spring-security-oauth2-resource-server
• MavenRepo: spring-security-oauth2-resource-server

  org.springframework.security:spring-security-oauth2-client:5.5.2
    org.springframework.security:spring-security-core:5.5.2
    org.springframework.security:spring-security-oauth2-core:5.5.2
    org.springframework.security:spring-security-web:5.5.2
  	
    org.springframework:spring-core:5.3.9
  

Spring Boot spring-boot-starter-security

• version: 2.5.4
• Spring.io: spring-boot security feature
• Spring.io: spring-boot starters
• GitHub: spring-boot-starters
• GitHub: spring-boot-starters oauth2 client
• GitHub: spring-boot-starters oauth2 resource server

Spring Cloud spring-cloud-security

• Spring.io: spring-cloud-security

Reference