Ankur Mhatre
e9381dc5be
Three modules on Spring Boot 4.1.1 with Spring Authorization Server 7.1.1: the provider
itself, a relying party, and an API that trusts its tokens. Client registration, PKCE,
a custom consent page and token customisation, with profiles that make each failure
reproducible.
Every claim is backed by captured output in docs/output/as-*.txt, regenerated by
authorization-server/scripts/run-all.sh. Notable findings, verified against the jars:
- OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(HttpSecurity) was deleted
in 7.0, and both configuration classes moved into spring-security-config
- ClientSettings.requireProofKey flipped from false to true, on the authorization server
(1.5.8 -> 7.1.1) and on the OAuth2 client (6.5.1 -> 7.1.1)
- requireProofKey(false) does not make PKCE optional for a public client; the code
verifier is that client's only authentication at the token endpoint
- MediaTypeRequestMatcher(TEXT_HTML) matches Accept: */*, so the token endpoint answers
API callers with 302 -> /login unless setIgnoredMediaTypes(ALL) is called
Also renames the repository to spring-auth-demo and cross-links the new chapter set from
the existing documentation.
Running your own OAuth2 / OIDC provider
Companion documentation for
Spring Authorization Server: Running Your Own OAuth2 / OIDC Provider
on ankurm.com, and for the code in authorization-server/.
Where the other two projects in this repository consume tokens, this one mints them.
docs/01–18 cover a hand-written JWT filter and a resource server in front of
somebody else's issuer; the chapters here cover the issuer itself.
| JDK | Temurin 25.0.4.1+1 (current LTS) |
| Spring Boot | 4.1.1 |
| Spring Framework | 7.0.9 |
| Spring Security | 7.1.1 |
| Spring Authorization Server | 7.1.1 — the same artifact, now versioned with Spring Security |
| Maven | 3.9.11 |
Everything in docs/output/as-*.txt is real program output, regenerated by
authorization-server/scripts/run-all.sh.
Chapters
| # | chapter | what it settles |
|---|---|---|
| 01 | Versions, artifacts and the 7.0 move | why there is no SAS version to pin any more, and which starter to use |
| 02 | The minimum working provider | two filter chains, and the API that replaced applyDefaultSecurity |
| 03 | Clients, PKCE and the defaults that moved | requireProofKey flipped to true on both sides |
| 04 | The consent page | the form contract, and the redirect loop you get for breaking it |
| 05 | Token customisation | the bean the JWT generator looks for, and the one it ignores |
| 06 | The resource server side | what issuer-uri does and does not validate |
| 07 | Diagnostics | reading the effective configuration back out of the running server |
| 08 | The relying party | driving a real browser flow, and the client-side PKCE default |
| 09 | The entry point and the Accept header | why the token endpoint 302s to a login page |
| 10 | Should you run one at all | the honest answer, and what you are signing up for |
Captured output
| file | produced by |
|---|---|
as-settings-defaults.txt |
scripts/settings-defaults.sh |
as-legacy-compile-failure.txt |
scripts/compile-legacy.sh |
as-missing-consent-service.txt |
a real startup failure, kept |
as-discovery.txt |
scripts/discovery.sh |
as-client-credentials.txt |
scripts/client-credentials.sh |
as-client-credentials-noclaims.txt |
same, noclaims profile |
as-client-credentials-opaque.txt |
same, opaque profile |
as-authcode-pkce.txt |
scripts/authcode-pkce.sh, public client |
as-authcode-web.txt |
same, confidential client |
as-authcode-noclaims.txt |
same, noclaims profile |
as-authcode-noconsent.txt |
same, noconsent profile |
as-authcode-nopkce.txt |
same, nopkce profile, challenge still sent |
as-authcode-nochallenge.txt |
same, nopkce profile, no challenge at all |
as-authcode-pkce-enforced.txt |
same, defaults, no challenge — rejected |
as-pkce-applier.txt |
scripts/pkce-applier.sh |
as-client-flow.txt |
scripts/client-flow.sh |
as-client-flow-nopkce.txt |
same, pre-7.0 client |
as-entrypoint-accept.txt |
scripts/entrypoint-accept.sh |
as-audience.txt |
scripts/audience.sh |
as-rs-startup-failure.txt |
scripts/rs-startup-failure.sh |
as-test-run.txt |
mvn -pl auth-server test |