Spring Securiy New Support for OAuth 2.0 and OpenID Connect 1.0

陈振阳

已于 2022-09-26 23:09:34 修改

阅读量673

点赞数

CC 4.0 BY-SA版权

分类专栏： Spring Security 文章标签： spring java 后端

于 2018-05-12 10:52:15 首次发布

本文链接：https://blog.csdn.net/xichenguan/article/details/80289547

Spring Security 专栏收录该内容

30 篇文章

订阅专栏

Spring Security 5引入了对OAuth2.0授权框架及OpenID Connect 1.0的支持，主要聚焦于OAuth客户端角色，允许通过Facebook、Google等提供商进行用户认证。通过授权码授予流程实现如“使用Google登录”的功能。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

New Support for OAuth 2.0 and OpenID Connect 1.0

We are very excited to introduce new support for OAuth 2.0 Authorization Framework and OpenID Connect 1.0 in Spring Security 5. The initial support in M1 is primarily focused on the OAuth Client role, providing the capability for authenticating the end-user against an OAuth 2.0 Provider (for example, Facebook) or an OpenID Connect 1.0 Provider (for example, Google).

The OAuth 2.0 Login feature essentially realizes the use case “Login with Google” or “Login with Facebook” and is implemented by leveraging the Authorization Code Grant flow, as specified in the OAuth 2.0 Authorization Framework.

The best place to start learning on how to use OAuth 2.0 Login is to follow the guide and associated sample. The guide will walk you through setting up OAuth 2.0 Login with Google, GitHub, Facebook and Okta.
The Future of OAuth in Spring Security

Support for OAuth is currently spread out in the following Spring projects:

Spring Security OAuth
Spring Social
Spring Cloud Security
Spring Boot’s OAuth2 SSO Support

With Spring Security 5, the main direction going forward is to build first-class support for
OAuth 2.0 Authorization Framework, OpenID Connect 1.0, JWT, and JOSE (JWS/JWE/JWK) into Spring Security proper. The goal is to have Spring Security “house” the core logic for the lower-level protocol flows, for example, the “authorization code grant” flow, which would then be reused by the various Spring projects requiring it, such as, Spring Social. A lot of the protocol flow logic has already been implemented in Spring Security OAuth, however, the decision was made to do a re-write as we incorporate it into Spring Security proper. That being said, the Spring Security OAuth project is in maintenance mode as we are limiting new features and focusing on bug fixes and minor enhancements only. Our efforts going forward will be focused on building out the support within Spring Security.

The ultimate goal with the new support for OAuth 2.0 and OpenID Connect 1.0 is to provide an easy-to-use abstraction on top of the lower-level protocol flows that are inherently complex. In order to move quickly and stay current, we are leveraging Nimbus OAuth 2.0 and OIDC SDK for our internal implementation. As a key preliminary step before we proceeded with the re-write, we researched and evaluated existing OAuth 2.0 and OpenID Connect 1.0 Java libraries available in the open source community and documented our findings here. As a result of this evaluation phase, we found Nimbus OAuth 2.0 and OIDC SDK to be the most mature and comprehensive Java library available today as it provides extensive support for all the relevant specifications.

In the upcoming 5.0.0 M2 release we plan to build further support for reactive based security and OAuth 2.0 and OpenID Connect 1.0. We would greatly appreciate any feedback on these new features and if you have anything that you would like prioritized, please create an issue.

转自：https://spring.io/blog/2017/05/11/spring-security-5-0-0-m1#the-future-of-oauth-in-spring-security