spring-projects/spring-authorization-server
Spring Authorization Server
Spring Authorization Server is an OAuth 2.1 and OpenID Connect 1.0 authorization server built on Spring Security. It implements the full protocol surface for issuing access and refresh tokens, including authorization code, client credentials, device code, and token exchange grants, as well as pushed authorization requests and user consent management. The server also functions as an OpenID Connect provider, supporting ID tokens, userinfo, discovery, logout, and dynamic client registration.
The project distinguishes itself through an extensible framework that allows custom grant types, pluggable token formats (self-contained JWTs or opaque references), DPoP proof-of-possession binding, and per-issuer tenancy for serving multiple isolated tenants on a single host. Client authentication supports shared secrets, signed JWTs, mutual TLS, and public clients with PKCE enforcement. Consent decisions can be persisted in a database or cache to avoid repeated authorization prompts.
Beyond core flows, the server provides standard protocol endpoints for introspection, revocation, and metadata discovery, along with token customization for adding, modifying, or removing claims. Core services such as the client repository and token generator can be replaced, and request processing can be customized per endpoint. The project offers out-of-the-box persistence via JPA or Redis for authorization state, and its default bootstrapping registers all required OAuth 2.1 and OpenID Connect endpoints automatically when used within a Spring Boot application.
Features
- Authorization Server Implementations - Issues access and refresh tokens using standard OAuth 2.1 grants and client authentication methods.
- OAuth State Persistence Backends - Provides storage for client registrations, consents, and authorization codes using JPA or Redis.
- OAuth 2.1 and OpenID Connect Server Bootstrapping - This OAuth 2.1 and OpenID Connect authorization server provides a minimal default configuration that registers all required OAuth2 and OpenID Connect protocol endpoints and infrastructure.
- Pluggable Token Formats - This OAuth 2.1 and OpenID Connect authorization server generates access tokens in either self-contained JWT format or opaque reference tokens as configured.
- Client Authentication Configurations - Supports client authentication via shared secrets, signed JWTs, mutual TLS, and public clients with PKCE enforcement.
- Custom OAuth Grant Types - This OAuth 2.1 and OpenID Connect authorization server allows defining new authorization grant types by implementing custom authentication converters and providers.
- OAuth 2.0 Authorization Flows - Processes authorization code, client credentials, refresh token, device code, and token exchange grant flows with user consent.
- OAuth 2.1 Implementations - Implements the full set of OAuth 2.1 and OpenID Connect protocol endpoints with dedicated request parsing and response construction for each action.
- Authorization Metadata - This OAuth 2.1 and OpenID Connect authorization server publishes its configuration, endpoints, and public signing keys via standard discovery documents and JWK set endpoints.
- OpenID Connect Providers - Authenticates end users and provides identity claims and ID tokens for single sign-on across applications.
- Per-Issuer Tenant Isolations - This OAuth 2.1 and OpenID Connect authorization server serves multiple tenants by isolating client registrations and user stores, running multiple issuers on a single host.
- Token Introspection and Revocation Endpoints - This OAuth 2.1 and OpenID Connect authorization server validates active token state through introspection and invalidates tokens via revocation endpoints.
- Token Claim Customizations - This OAuth 2.1 and OpenID Connect authorization server allows adding, replacing, or removing custom claims on JWT access tokens and OpenID Connect ID tokens.
- Pushed Authorization Requests - This OAuth 2.1 and OpenID Connect authorization server accepts pushed authorization requests submitted directly by the client, returning a request URI for later use.
- Spring Boot Integrations - Provides a customizable OAuth 2.1 and OpenID Connect authorization server built on Spring Security within a Spring Boot application.
- Authorization Policy Isolators - Serves multiple independent tenants with isolated client registrations and user stores within a single authorization server instance.
- Static - This OAuth 2.1 and OpenID Connect authorization server registers OAuth2 client metadata either statically or dynamically per the OpenID Connect protocol, including identifiers, secrets, and grants.
- OAuth 2.1 Core Service Replacements - This OAuth 2.1 and OpenID Connect authorization server allows replacing core services like client repository and token generator, and customizing request processing for each protocol endpoint.
- Custom Client Authentication Converters and Providers - This OAuth 2.1 and OpenID Connect authorization server allows adding, removing, or customizing converters and providers that extract and verify client credentials from incoming requests.
- Persistent Consent Stores - Stores and retrieves resource owner consent decisions to avoid repeating authorization prompts across sessions.
- Token Claim Injectors - Adds custom claims to access tokens and UserInfo responses to include application-specific user attributes and roles.
- DPoP Proof Verifications - Provides DPoP proof verification to bind access tokens to client public keys and prevent replay attacks.
- UserInfo Endpoints - This OAuth 2.1 and OpenID Connect authorization server provides the standard OpenID Connect UserInfo endpoint returning identity claims about an authenticated user.
- External Provider Integrations - This OAuth 2.1 and OpenID Connect authorization server authenticates users through OAuth2 authorization code flow with external providers like Google or GitHub, mapping claims and federated registration.
