OAuth 2 support in Spring Security

Spring Security provides OAuth 2 authorization support following Spring Framework programming models and configuration idioms.

In the following section we will identify the main components involved in OAuth 2 flow.

Resource owner

The resource owner can be one or multiple sources, and in the context of the JBCP calendar, it is going to have the calendar application as the resource owner. The JBCP calendar will not have any specific configuration that is needed to denote its ownership aside from configuring the resource server.

Resource server

Most of the resource server support is consolidated in spring-security-oauth2-resource-server. However, the decoding and verification of JWTs are handled by spring-security-oauth2-jose. Therefore, both components are essential for a functional resource server that can handle JWT-encoded Bearer Tokens.

In Spring Boot, setting up an application as a resource server involves two fundamental steps...