spring-authorization-server VS angular-spa-sample

I use this https://github.com/spring-projects/spring-authorization-server for smaller projects or experimentations. Keeps all the moving parts without going to a 3rd party.

In this section we will use Spring Authorization Server to build an authorization server.In addition, we will also customize the access_token and custom user information endpoints.

You can spin one up in Spring (Java) fairly quickly and boilerplate - Main page and Getting Started Guide.

Is Spring Authorization Server ready for production? Does it only use OAuth 2.1? We currently use `org.springframework.security.oauth.boot:spring-security-oauth2-autoconfigure` in our apps with OAuth2 JWT with grant types `password`, and `refresh_token`. If we update our authorization server with Spring Authorization Server, do we have to change all functionalities? Can we use OAuth2 or do we have to start using OAuth2.1?

At the moment of writing this it seems like the documentation is also in the early stages, although I wouldn't expect too much from the documentation later on either if it was to be judged by the docs for the rest of the spring security. You can find the official docs here.

Your example is pretty unconventional though — it seems like you're sort of rolling your own authorization server which will make things difficult. The project has been diligent about removing support for "issuing" JWTs and things like that. If you asked a maintainer about your current approach they'd probably point you to https://spring.io/projects/spring-authorization-server.

It has becone so boilerplate, Spring is actually helping Take a look at: Spring Auth Server

Spring Auth Server

Most of the time, and most examples, will be about using OAuth as a client. But in your case you want to have your own OAuth and Open ID server which will be federated with Facebook and Google. All that means is that you will then have an OAuth server that is also someone else's client, such that your apps authenticate with your server which then uses their servers to actually identify users. This will also come in handy later if you want to set up permissions and what not. Besides Keycloak you might want to look into WSO2 IS or Auth0. Keycloak and WSO2 IS can be run locally, while Auth0 is a cloud service. I'd go with either Keycloak or Auth0. If you go the Spring Authorization Server route, they rolled up an example of federation on the project's Github page. Oauth can be pretty complicated though so I'd suggest that you start off with a ready-made solution. If you stick to Spring Oauth2 Client and avoid things like using Keycloak's specific adapter, it should be easy enough to swap OAuth servers later on. Regarding SAML, I've never used it. I think OAuth is way more prevalent in web development. Here's a comparison, I found it informative. You mentioned tutorials... I bought this course on Udemy last year and it was pretty nice. I browsed some tutorials, and I think this is what you need if you go with Keycloak, assuming you're using Keycloak on the server. If you want to authenticate users on the frontend (running on the browser), you'll want a PKCE flow example.

Spring has an oauth2 authorization server that is currently in early release: https://github.com/spring-projects/spring-authorization-serv...

I'm building something with it currently and it's quite nice, especially if you are already familiar with spring security. Documentation is quite sparse tho.

There is a document meant for best practices for browser-based apps such as SPA/PWA, which includes use of code flow.

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-brows...

(disclaimer - co-author)

The catch is that since the client web origin and AS web origin are often different sites, the AS has to actually implement CORS on their token endpoint.

Some implementations unfortunately (perhaps due to a misunderstanding about what CORS is meant to accomplish) make this a per-tenant/per-installation allowlist of origins on the AS.

Auth0 and Ping Identity (my employer) document CORS settings for products. I'm not sure about AWS and you might need to add CORS via API gateway. Azure AD supports CORS for the token endpoint, but they may limit domains in some manner (such as redirect uri of registered clients).

FWIW, I created a demo ages ago (at https://github.com/pingidentity/angular-spa-sample), which by default is configured to target Google for OpenID Connect and uses localhost for local development/testing. It hasn't aged particularly well in terms of library choices, but I do keep it running.

A deployment based on older Angular is also at https://angular-appauth.herokuapp.com to try - IIRC I used a node server just to deal with wildcard path resolution of the index file, but there's otherwise no local logic.

oh well you alrady have a provider then! here is the boilerplate to integrate with ping https://github.com/pingidentity/angular-spa-sample