This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Security 6.5.3!

OAuth 2.1 Authorization Server

The OAuth 2.1 Authorization Server features provide support for the Authorization Server role as defined in the OAuth 2.1 Authorization Framework.

The Authorization Server features provide implementations of the OAuth 2.1 and OpenID Connect 1.0 specifications and other related specifications. It provides a secure, light-weight, and customizable foundation for building OpenID Connect 1.0 Identity Providers and OAuth 2.1 Authorization Server products.

Use Cases

The following list provides some use cases for using Spring Security Authorization Server compared to using an open source or commercial OAuth2 or OpenID Connect 1.0 Provider product.

  • Provides full control of configuration and customization when advanced customization scenarios are required.

  • Preference for a light-weight authorization server compared to a commercial product that includes all the "bells and whistles".

  • Potential savings in software licensing and/or hosting costs.

  • Quick startup and ease of use during development using the familiar Spring programming model.

Feature List

Spring Security Authorization Server supports the following features:

Category Feature Related specifications

Authorization Grant

Token Formats

  • Self-contained (JWT)

  • Reference (Opaque)

Token Types

  • OAuth 2.0 Demonstrating Proof of Possession (DPoP) (RFC 9449)

Client Authentication

  • client_secret_basic

  • client_secret_post

  • client_secret_jwt

  • private_key_jwt

  • tls_client_auth

  • self_signed_tls_client_auth

  • none (public clients)

  • The OAuth 2.1 Authorization Framework (Client Authentication)

  • JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication (RFC 7523)

  • OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens (RFC 8705)

  • Proof Key for Code Exchange by OAuth Public Clients (PKCE) (RFC 7636)

Protocol Endpoints

Section Summary