|
@@ -1,109 +1,12 @@
|
|
|
|
+:noheader:
|
|
[[top]]
|
|
[[top]]
|
|
-= Overview
|
|
|
|
-:page-section-summary-toc: 1
|
|
|
|
-Joe Grandja, Steve Riesenberg
|
|
|
|
-v{spring-authorization-server-version}
|
|
|
|
-:docinfo: private-footer
|
|
|
|
-:nofooter:
|
|
|
|
-
|
|
|
|
-This site contains reference documentation and how-to guides for Spring Authorization Server.
|
|
|
|
|
|
+= Spring Authorization Server Reference
|
|
|
|
|
|
[horizontal]
|
|
[horizontal]
|
|
-xref:index.adoc#introducing-spring-authorization-server[Introduction] :: Introduction and feature list
|
|
|
|
|
|
+xref:overview.adoc[Overview] :: Introduction and feature list
|
|
xref:getting-help.adoc[Getting Help] :: Links to samples, questions and issues
|
|
xref:getting-help.adoc[Getting Help] :: Links to samples, questions and issues
|
|
xref:getting-started.adoc[Getting Started] :: System requirements, dependencies and developing your first application
|
|
xref:getting-started.adoc[Getting Started] :: System requirements, dependencies and developing your first application
|
|
xref:configuration-model.adoc[Configuration Model] :: Default configuration and customizing the configuration
|
|
xref:configuration-model.adoc[Configuration Model] :: Default configuration and customizing the configuration
|
|
xref:core-model-components.adoc[Core Model / Components] :: Core domain model and component interfaces
|
|
xref:core-model-components.adoc[Core Model / Components] :: Core domain model and component interfaces
|
|
xref:protocol-endpoints.adoc[Protocol Endpoints] :: OAuth2 and OpenID Connect 1.0 protocol endpoint implementations
|
|
xref:protocol-endpoints.adoc[Protocol Endpoints] :: OAuth2 and OpenID Connect 1.0 protocol endpoint implementations
|
|
xref:how-to.adoc[How-to Guides] :: Guides to get the most from Spring Authorization Server
|
|
xref:how-to.adoc[How-to Guides] :: Guides to get the most from Spring Authorization Server
|
|
-
|
|
|
|
-
|
|
|
|
-[[introducing-spring-authorization-server]]
|
|
|
|
-== Introducing Spring Authorization Server
|
|
|
|
-
|
|
|
|
-Spring Authorization Server is a framework that provides implementations of the https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07[OAuth 2.1] and https://openid.net/specs/openid-connect-core-1_0.html[OpenID Connect 1.0] specifications and other related specifications.
|
|
|
|
-It is built on top of https://spring.io/projects/spring-security[Spring Security] to provide a secure, light-weight, and customizable foundation for building OpenID Connect 1.0 Identity Providers and OAuth2 Authorization Server products.
|
|
|
|
-
|
|
|
|
-[[feature-list]]
|
|
|
|
-== Feature List
|
|
|
|
-
|
|
|
|
-Spring Authorization Server supports the following features:
|
|
|
|
-
|
|
|
|
-[cols="2a,4a,6a"]
|
|
|
|
-|===
|
|
|
|
-|Category |Feature |Related specifications
|
|
|
|
-
|
|
|
|
-|xref:protocol-endpoints.adoc#oauth2-token-endpoint[Authorization Grant]
|
|
|
|
-|
|
|
|
|
-* Authorization Code
|
|
|
|
-** xref:protocol-endpoints.adoc#oauth2-authorization-endpoint[User Consent]
|
|
|
|
-* Client Credentials
|
|
|
|
-* Refresh Token
|
|
|
|
-* Device Code
|
|
|
|
-** xref:protocol-endpoints.adoc#oauth2-device-verification-endpoint[User Consent]
|
|
|
|
-|
|
|
|
|
-* The OAuth 2.1 Authorization Framework (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07[draft])
|
|
|
|
-** https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#section-4.1[Authorization Code Grant]
|
|
|
|
-** https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#section-4.2[Client Credentials Grant]
|
|
|
|
-** https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#section-4.3[Refresh Token Grant]
|
|
|
|
-* OpenID Connect Core 1.0 (https://openid.net/specs/openid-connect-core-1_0.html[spec])
|
|
|
|
-** https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[Authorization Code Flow]
|
|
|
|
-* OAuth 2.0 Device Authorization Grant
|
|
|
|
-(https://tools.ietf.org/html/rfc8628[spec])
|
|
|
|
-** https://tools.ietf.org/html/rfc8628#section-3[Device Flow]
|
|
|
|
-
|
|
|
|
-|xref:core-model-components.adoc#oauth2-token-generator[Token Formats]
|
|
|
|
-|
|
|
|
|
-* Self-contained (JWT)
|
|
|
|
-* Reference (Opaque)
|
|
|
|
-|
|
|
|
|
-* JSON Web Token (JWT) (https://tools.ietf.org/html/rfc7519[RFC 7519])
|
|
|
|
-* JSON Web Signature (JWS) (https://tools.ietf.org/html/rfc7515[RFC 7515])
|
|
|
|
-
|
|
|
|
-|xref:configuration-model.adoc#configuring-client-authentication[Client Authentication]
|
|
|
|
-|
|
|
|
|
-* `client_secret_basic`
|
|
|
|
-* `client_secret_post`
|
|
|
|
-* `client_secret_jwt`
|
|
|
|
-* `private_key_jwt`
|
|
|
|
-* `none` (public clients)
|
|
|
|
-|
|
|
|
|
-* The OAuth 2.1 Authorization Framework (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#section-2.4[Client Authentication])
|
|
|
|
-* JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication (https://tools.ietf.org/html/rfc7523[RFC 7523])
|
|
|
|
-* Proof Key for Code Exchange by OAuth Public Clients (PKCE) (https://tools.ietf.org/html/rfc7636[RFC 7636])
|
|
|
|
-
|
|
|
|
-|xref:protocol-endpoints.adoc[Protocol Endpoints]
|
|
|
|
-|
|
|
|
|
-* xref:protocol-endpoints.adoc#oauth2-authorization-endpoint[OAuth2 Authorization Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oauth2-device-authorization-endpoint[OAuth2 Device Authorization Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oauth2-device-verification-endpoint[OAuth2 Device Verification Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oauth2-token-endpoint[OAuth2 Token Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oauth2-token-introspection-endpoint[OAuth2 Token Introspection Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oauth2-token-revocation-endpoint[OAuth2 Token Revocation Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oauth2-authorization-server-metadata-endpoint[OAuth2 Authorization Server Metadata Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#jwk-set-endpoint[JWK Set Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oidc-provider-configuration-endpoint[OpenID Connect 1.0 Provider Configuration Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oidc-logout-endpoint[OpenID Connect 1.0 Logout Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oidc-user-info-endpoint[OpenID Connect 1.0 UserInfo Endpoint]
|
|
|
|
-* xref:protocol-endpoints.adoc#oidc-client-registration-endpoint[OpenID Connect 1.0 Client Registration Endpoint]
|
|
|
|
-|
|
|
|
|
-* The OAuth 2.1 Authorization Framework (https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07[draft])
|
|
|
|
-** https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#section-3.1[Authorization Endpoint]
|
|
|
|
-** https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#section-3.2[Token Endpoint]
|
|
|
|
-* OAuth 2.0 Device Authorization Grant (https://tools.ietf.org/html/rfc8628[RFC 8628])
|
|
|
|
-** https://tools.ietf.org/html/rfc8628#section-3.1[Device Authorization Endpoint]
|
|
|
|
-** https://tools.ietf.org/html/rfc8628#section-3.3[Device Verification Endpoint]
|
|
|
|
-* OAuth 2.0 Token Introspection (https://tools.ietf.org/html/rfc7662[RFC 7662])
|
|
|
|
-* OAuth 2.0 Token Revocation (https://tools.ietf.org/html/rfc7009[RFC 7009])
|
|
|
|
-* OAuth 2.0 Authorization Server Metadata (https://tools.ietf.org/html/rfc8414[RFC 8414])
|
|
|
|
-* JSON Web Key (JWK) (https://tools.ietf.org/html/rfc7517[RFC 7517])
|
|
|
|
-* OpenID Connect Discovery 1.0 (https://openid.net/specs/openid-connect-discovery-1_0.html[spec])
|
|
|
|
-** https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig[Provider Configuration Endpoint]
|
|
|
|
-* OpenID Connect RP-Initiated Logout 1.0 (https://openid.net/specs/openid-connect-rpinitiated-1_0.html[spec])
|
|
|
|
-** https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout[Logout Endpoint]
|
|
|
|
-* OpenID Connect Core 1.0 (https://openid.net/specs/openid-connect-core-1_0.html[spec])
|
|
|
|
-** https://openid.net/specs/openid-connect-core-1_0.html#UserInfo[UserInfo Endpoint]
|
|
|
|
-* OpenID Connect Dynamic Client Registration 1.0 (https://openid.net/specs/openid-connect-registration-1_0.html[spec])
|
|
|
|
-** https://openid.net/specs/openid-connect-registration-1_0.html#ClientRegistration[Client Registration Endpoint]
|
|
|
|
-** https://openid.net/specs/openid-connect-registration-1_0.html#ClientConfigurationEndpoint[Client Configuration Endpoint]
|
|
|
|
-|===
|
|
|