OAuth2 and OpenID Connect | Authorization Server with Spring Security 1 

Awesome content...complex topic covered with such clarity thanks

I think it's a master tutorial for understanding spring security oAuth2 concept. Thanks.

Exactly what I wanted. Thank you!

Extraordinary explanation, great

Such a wonderfull content even i have working on keylock but still lot of information

Great explanation. Thank you

i m your fan and subscriber. u nailed this topic man

hello, very good video. I would like to go deeper into this topic. I'm doing my master's thesis and I have to use oauth2 anyway. How would the same thing be done if I use microservices and a gateway. how could I ask you several questions. Thanks a lot

Very nice explanation!

Is it possible to give two applications same client id? or will have to register both applications independently?

awesome content. please keep going

Hello brother, may I ask you a question? Why do we need two clients here, what are their difference and if I just want to access the protected resource server with some token, can I configure just one client. Especially I don't understand why we need the message-client-oidc here.

Awesome! Thanks

I cant figure out how to get the Security chain for the Resource server to work. mvcmatchers isn't in spring security now.

Great explanation, Consider this : I have two client apps registered in auth server with contexts say /app1 and /app2. Now when I hit /app1 it redirects me to login page, Now when I log in for app1 I don't want to give credentials again for /app2, I want it to automatically authenticate me for app2 as well (vice versa). how can I achieve this sso kinda thing ?

ClientRegistrationRepository and OAuth2AuthorizedClientRepository - Could not autowire. No beans of ' Rep ' type found. Why?

It feels natural that client should be a JS app, some SPA app, is it possible to do? client - react app, resource - spring app, authorization - spring app. If possible, what is the flow at the client side?

Great work! Is there a way to get the Authorization code via REST request sending username and password in a body or headers?

Sir i am getting this error This application has no explicit mapping for /error, so you are seeing this as a fallback. Tue Dec 20 23:05:26 IST 2022 There was an unexpected error (type=Bad Request, status=999).

thank you for this tutorial, i followed it step by step, but now i am wondering how did you run the them and tested them together! can someone tell me please

Can you extend this spring authorisation server uses federated authorisation I.e: social login

Nice video. I cloned the repo. But the project you are referring in the video and the one which I cloned looks different.

I have cloned the project during the project setup I am getting error at WebClient declaration saying it may not have been initialized same in UserRepository and PasswordEncoder

Nice Video. I saw many written doc, But I found your video latest one for Authorization server. Thank You. Shall you please Make video or comment about why, when to use OAUTH2 client, OAUTH2 Server, OAUTH2 SDK ?. Google , Git hub , OKTA credential login authenticate with OAUTH2 client is enough ? Need a authorization server ?

Hi Sergio, I write you because I follow your tutorial step by step but in the minute 23:28 of the tutorial when you tried to access to the client, the result should be to redirect to login page of the backend-auth server but in my case I got the follow error message: "There was an unexpected error (type=Bad Request, status=400). [invalid_request] OAuth 2.0 Parameter: redirect_uri" I checked and I can see I have the exact same code, I tried to resolved this issue myself but I couldn't find an anwser about this error. Can you help me please to resolved it? Thanks & Regards

Good one.

Hello, I have problem during build of backend-client module, I have got "UnsatisfiedDependencyException" during compiling webClient at message controller, Is there anyone who can help me?

Could you make a new VDO about Openid connect for authenticate LDAP ?

Thanks alot. I was hunting for info on how to combine spring auuth. jwt tokens (resource server)? and api-gateway (cloud). Will try to see if it works in my case.

Awesome

I find this way of setting the spring authorization server very fancy in this video, but I encountered lot of bugs trying to reproduce the exact codes; because in the Backend-auth project and in the UserAuthenticationConverter of the Config package, the editor complains saying the the method getPassword() is undefined in the UserDto, so I create the getter of password field inside UserDto and the error is gone. But when building the Backend-auth project, the build failed with three errors. These are the errors: 1 - Caused by: org.springframework.beans.factory.beanCreationException: error creating bean with name 'EntityManagerFactory' defined in classPath resource org/springframework/boot/autoConfigure/orm/jpa/HibernateJpaConfiguration.class 2- Caused by: org.hibernate.service.spi.ServiceException: Unable to create requested service org.hibernate.engine.jdbc.env.spi.JdbcEnvironnement 3- Caused by: org.hibernate.hibernateException: Access to DialectResolutionInfo cannot be null when 'hibernate.dialect' not set I want to also add that I created a docker volume for the 'authdb' postgres database and created the 'auth-usr' with the 'pwd' password as well, but when I try the '\dt' to show the created 'auth_user' Table, the console says there is no relation. Also I realized the the schema.sql is not called from the datasorce of application.yml of Backend-auth project, why shouldn't it ? I thing there comes the errors, but not sure. I just want to know what I'm missing, since I found this video meaningfull. Thanks in advance !

Super )

Thanks

Spring Security needs a DSL to make this more intuitive because programmatically it’s very obtuse.

Hey man can you create a tutorial about Spring ACL its kinda hard topic for someone exploring authentication/authorization thankss love your content

In the application.yml of backend-client service, you set ‘client-id’ : ‘messages-client’ and ‘client-secret’ : secret. But in the securityConfig file of backend-auth service you set in RegisteredClientRepository .clientId(‘messages-client’).clientSecret(‘AnEncryptedPAssword). I just want to ask which encryted password was used there inside the .clientSecret(). I ask this because the backend-client project failed on build saying that it cannot create Bean with name ‘messagesController’, and after checking, it appeared to me that backend-client failed to reach the backend-resources endpoint because it’s still unauthorized. So which password should I put in the .clientSecret() ? The One in the data.sql or that of auth_usr. I tried all that and still unauthorized. I just don’t figure out with which credentials the backend-client is finally authorized from the video. Thanks for clarification.

Did anybody try to use authorization server and angular app as oauth2 client?

Could you provide more detailed documentation how to set up KeyCloak service? after louncing project i'm got error : Unable to resolve Configuration with the provided Issuer of "backend-keycloak-auth:8080/auth/realms/my_realm"

First of all, thank you for your video. I benefited a lot from it. In the process of learning, I met a question, which I would like to ask you auth and resource services are normal, backend-auth:8081 can be accessed normally, but clientId reported the following error when starting, thank you boss Caused by: java.lang.IllegalArgumentException: Unable to resolve Configuration with the provided Issuer of "backend-auth:8081"

Great explanation. Thanks

How did you get the value for clientSecret? Or can it be encrypted by any encoder?