🍃Spring Boot

Implementing OAuth2 in Spring Boot

Updated 2026-05-15

10 min read

Implementing OAuth2 in Spring Boot

Introduction

OAuth2 is an authorization protocol that provides applications secure designated access. It allows third-party services to access user information without exposing passwords. In this tutorial, we will walk through the steps to implement OAuth2 authentication and authorization using Spring Boot.

Spring Security OAuth2 is a comprehensive solution for securing your applications with OAuth2. It offers various features such as Authorization Server, Resource Server, and Client Management. We will focus on setting up an Authorization Server and a Resource Server in this guide.

Concept

OAuth2 works by issuing tokens to third-party clients that allow them to access user information without exposing passwords. The process involves several steps:

Authorization Request: The client requests authorization from the resource owner.
Authorization Grant: If authorized, the resource owner grants an authorization grant to the client.
Access Token Request: The client exchanges the authorization grant for an access token.
Access Token: The client uses the access token to access protected resources.

Spring Boot simplifies this process by providing pre-built components and configurations for OAuth2.

Examples

Step 1: Set Up Your Spring Boot Project

First, create a new Spring Boot project using Spring Initializr (https://start.spring.io/). Choose Maven or Gradle as your build tool. Add the following dependencies:

Spring Web
Spring Security
OAuth2 Authorization Server

If you are using Maven, add these dependencies to your pom.xml:

XML

1<dependencies>
2  <dependency>
3      <groupId>org.springframework.boot</groupId>
4      <artifactId>spring-boot-starter-web</artifactId>
5  </dependency>
6  <dependency>
7      <groupId>org.springframework.boot</groupId>
8      <artifactId>spring-boot-starter-security</artifactId>
9  </dependency>
10  <dependency>
11      <groupId>org.springframework.security.oauth.boot</groupId>
12      <artifactId>spring-security-oauth2-authorization-server</artifactId>
13  </dependency>
14</dependencies>

Step 2: Configure the Authorization Server

Create a configuration class for the authorization server. This class will define the endpoints and the token store.

Java

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.annotation.web.builders.HttpSecurity;
4import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
5import org.springframework.security.core.userdetails.User;
6import org.springframework.security.core.userdetails.UserDetails;
7import org.springframework.security.core.userdetails.UserDetailsService;
8import org.springframework.security.provisioning.InMemoryUserDetailsManager;
9 
10@Configuration
11@EnableWebSecurity
12public class SecurityConfig {
13 
14  @Bean
15  public UserDetailsService userDetailsService() {
16      UserDetails user = User.withDefaultPasswordEncoder()
17          .username("user")
18          .password("password")
19          .roles("USER")
20          .build();
21      return new InMemoryUserDetailsManager(user);
22  }
23 
24  @Bean
25  public HttpSecurity http(HttpSecurity http) throws Exception {
26      http
27          .authorizeRequests(authorize -> authorize
28              .anyRequest().authenticated()
29          )
30          .formLogin(withDefaults());
31      return http;
32  }
33}

Step 3: Configure the Authorization Server Properties

Add the following properties to your application.properties file:

properties

1spring.security.oauth2.authorization-server.registration.client-id=client
2spring.security.oauth2.authorization-server.registration.client-secret=secret
3spring.security.oauth2.authorization-server.registration.scopes=read,write

Step 4: Create a Resource Server

Create another Spring Boot project for the resource server. Add the following dependencies:

Spring Web
Spring Security

If you are using Maven, add these dependencies to your pom.xml:

XML

1<dependencies>
2  <dependency>
3      <groupId>org.springframework.boot</groupId>
4      <artifactId>spring-boot-starter-web</artifactId>
5  </dependency>
6  <dependency>
7      <groupId>org.springframework.boot</groupId>
8      <artifactId>spring-boot-starter-security</artifactId>
9  </dependency>
10</dependencies>

Step 5: Configure the Resource Server

Create a configuration class for the resource server. This class will define the security rules and the token store.

Java

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.annotation.web.builders.HttpSecurity;
4import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
5 
6@Configuration
7@EnableWebSecurity
8public class ResourceServerConfig {
9 
10  @Bean
11  public HttpSecurity http(HttpSecurity http) throws Exception {
12      http
13          .authorizeRequests(authorize -> authorize
14              .anyRequest().authenticated()
15          )
16          .oauth2ResourceServer(oauth2 -> oauth2
17              .jwt()
18          );
19      return http;
20  }
21}

Step 6: Test the OAuth2 Implementation

Start both the authorization server and the resource server. You can test the OAuth2 implementation by using a tool like Postman or curl.

Obtain an access token from the authorization server:

Terminal

curl -X POST http://localhost:8080/oauth/token -H "Authorization: Basic Y2xpZW50OnNlY3JldA==" -d grant_type=password -d username=user -d password=password

Output

{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3599,
"scope": "read write"
}

Use the access token to access a protected resource:

Terminal

curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." http://localhost:8081/protected

Output

{
"message": "Hello, this is a protected resource!"
}

What's Next?

Now that you have implemented OAuth2 in Spring Boot, you can explore more advanced topics such as Microservices Basics with Spring Boot. This will help you understand how to build scalable and maintainable microservices architectures using Spring Boot.

If you have any questions or need further clarification on any of the steps, feel free to ask in the comments section below.

🍃Spring Boot

Implementing OAuth2 in Spring Boot

Updated 2026-05-15

10 min read

Implementing OAuth2 in Spring Boot

Introduction

Concept

OAuth2 works by issuing tokens to third-party clients that allow them to access user information without exposing passwords. The process involves several steps:

Authorization Request: The client requests authorization from the resource owner.
Authorization Grant: If authorized, the resource owner grants an authorization grant to the client.
Access Token Request: The client exchanges the authorization grant for an access token.
Access Token: The client uses the access token to access protected resources.

Spring Boot simplifies this process by providing pre-built components and configurations for OAuth2.

Examples

Step 1: Set Up Your Spring Boot Project

First, create a new Spring Boot project using Spring Initializr (https://start.spring.io/). Choose Maven or Gradle as your build tool. Add the following dependencies:

Spring Web
Spring Security
OAuth2 Authorization Server

If you are using Maven, add these dependencies to your pom.xml:

XML

1<dependencies>
2  <dependency>
3      <groupId>org.springframework.boot</groupId>
4      <artifactId>spring-boot-starter-web</artifactId>
5  </dependency>
6  <dependency>
7      <groupId>org.springframework.boot</groupId>
8      <artifactId>spring-boot-starter-security</artifactId>
9  </dependency>
10  <dependency>
11      <groupId>org.springframework.security.oauth.boot</groupId>
12      <artifactId>spring-security-oauth2-authorization-server</artifactId>
13  </dependency>
14</dependencies>

Step 2: Configure the Authorization Server

Create a configuration class for the authorization server. This class will define the endpoints and the token store.

Java

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.annotation.web.builders.HttpSecurity;
4import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
5import org.springframework.security.core.userdetails.User;
6import org.springframework.security.core.userdetails.UserDetails;
7import org.springframework.security.core.userdetails.UserDetailsService;
8import org.springframework.security.provisioning.InMemoryUserDetailsManager;
9 
10@Configuration
11@EnableWebSecurity
12public class SecurityConfig {
13 
14  @Bean
15  public UserDetailsService userDetailsService() {
16      UserDetails user = User.withDefaultPasswordEncoder()
17          .username("user")
18          .password("password")
19          .roles("USER")
20          .build();
21      return new InMemoryUserDetailsManager(user);
22  }
23 
24  @Bean
25  public HttpSecurity http(HttpSecurity http) throws Exception {
26      http
27          .authorizeRequests(authorize -> authorize
28              .anyRequest().authenticated()
29          )
30          .formLogin(withDefaults());
31      return http;
32  }
33}

Step 3: Configure the Authorization Server Properties

Add the following properties to your application.properties file:

properties

1spring.security.oauth2.authorization-server.registration.client-id=client
2spring.security.oauth2.authorization-server.registration.client-secret=secret
3spring.security.oauth2.authorization-server.registration.scopes=read,write

Step 4: Create a Resource Server

Create another Spring Boot project for the resource server. Add the following dependencies:

Spring Web
Spring Security

If you are using Maven, add these dependencies to your pom.xml:

XML

1<dependencies>
2  <dependency>
3      <groupId>org.springframework.boot</groupId>
4      <artifactId>spring-boot-starter-web</artifactId>
5  </dependency>
6  <dependency>
7      <groupId>org.springframework.boot</groupId>
8      <artifactId>spring-boot-starter-security</artifactId>
9  </dependency>
10</dependencies>

Step 5: Configure the Resource Server

Create a configuration class for the resource server. This class will define the security rules and the token store.

Java

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.annotation.web.builders.HttpSecurity;
4import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
5 
6@Configuration
7@EnableWebSecurity
8public class ResourceServerConfig {
9 
10  @Bean
11  public HttpSecurity http(HttpSecurity http) throws Exception {
12      http
13          .authorizeRequests(authorize -> authorize
14              .anyRequest().authenticated()
15          )
16          .oauth2ResourceServer(oauth2 -> oauth2
17              .jwt()
18          );
19      return http;
20  }
21}

Step 6: Test the OAuth2 Implementation

Start both the authorization server and the resource server. You can test the OAuth2 implementation by using a tool like Postman or curl.

Obtain an access token from the authorization server:

Terminal

curl -X POST http://localhost:8080/oauth/token -H "Authorization: Basic Y2xpZW50OnNlY3JldA==" -d grant_type=password -d username=user -d password=password

Output

{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3599,
"scope": "read write"
}

Use the access token to access a protected resource:

Terminal

curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." http://localhost:8081/protected

Output

{
"message": "Hello, this is a protected resource!"
}

What's Next?

If you have any questions or need further clarification on any of the steps, feel free to ask in the comments section below.