Menu
Spring Security 5.2.2 has incorporated Spring Security OAuth project, but not AuthorizationServer or ResourceServer. What are the replacements to AuthorizationServer in Spring Security 5.2.2?
OAuth-2.0-Migration-Guide
This document contains guidance for moving OAuth 2.0 Clients and Resource Servers from Spring Security OAuth 2.x to Spring Security 5.2.x. Since Spring Security doesn’t provide Authorization Server support, migrating a Spring Security OAuth Authorization Server is out of scope for this document.
328
End of Life Notice The Spring Security OAuth project has reached end of life and is no longer actively maintained by VMware, Inc. This project has been replaced by the OAuth2 support provided by Spring Security and Spring Authorization Server.
So, we have seen how we can configure Spring Security with OAuth 2.0. The application is pretty simple and easy to understand and helps us understand the process fairly easily. We have used two kinds of authorization grant types and seen how we can use them to acquire access tokens for our client application.
OAuth 2.0, which stands for “Open Authorization”, is a standard designed to allow a website or application to access resources hosted by other web apps on behalf of a user. It replaced OAuth 1.0 in 2012 and is now the de facto industry standard for online authorization.
OAuth2 is an authorization framework that enables the application Web Security to access the resources from the client. To build an OAuth2 application, we need to focus on the Grant Type (Authorization code), Client ID and Client secret.
The first thing to note is that Spring Security OAuth 2.4.0 officially deprecates all its classes.
The second thing is that according to the Spring Security - OAuth 2.0 Features Matrix - FAQ:
We are no longer planning on adding Authorization Server support to Spring Security.
One solution is to use an OAuth2 authorization server such as Gluu or Keycloak, but depending on your usage and on the degree of customization you have made in your authorization server this is certainly not straightforward.
Due to Spring community protests, there is also some hope that an authorization server will still be implemented in Spring Security. According to Josh Cummings on Github :
We'd like to thank everyone for your feedback on the decision to not support Authorization Server. Due to this feedback and some internal discussions, we are taking another look at this decision. We'll notify the community on any progress.
See also : Spring Security OAuth 2.0 Roadmap Update
== Update 5 March 2020 ==
To answer the question of Joseph: "Any issue if we continue using it?": For now, no specific issues, Spring Security OAuth is still maintained but this will probably not be the case in a near future. Citing the same blog post as above:
The 2.3.x line will reach EOL in March 2020. We will support the 2.4.x line at least one year after reaching feature parity.
To that end, with the release of Spring Security 5.2, we are strongly encouraging users to start migrating their legacy OAuth 2.0 client and resource server applications to the new support in Spring Security 5.2.
== Update 15 April 2020 ==
A brand new Spring Authorization Server is announced. You can find it on Github.
== Update 7 May 2020 ==
As announced on the Spring blog:
[...] the plan is to provide patch and security fixes for the Spring Security Oauth 2.4.x and 2.5.x line until May 2021. Additionally, security fixes will be supported for the 2.5.x line until May 2022, at which point the project will have reached end-of-life.
== Update 09 July 2021 ==
The new Spring Authorization Server 0.1.2 is now available. According to the comments of Joe Grandja, there is no definite timeline for a production ready version and the APIs are still evolving.
== Update 19 August 2021 ==
The first officially supported production-ready version, Spring Authorization Server 0.2.0, is available : Spring Authorization Server goes to production !
== Update 24 March 2022 ==
Spring Authorization Server 0.2.3 is now available, but there is still no feature parity with the Authorization Server from the deprecated Spring Security OAuth project. Completed features can be found in the Github wiki. Advancement can be followed with the ZenHub board.
== Update 1 June 2022 ==
The Spring Security OAuth and Spring Security OAuth Boot 2 auto-configuration projects have reached end of life. See official blog post.
== Update 28 July 2022 ==
Spring Authorization Server 1.0 is annouced for November 2022. It will required Spring 6, JDK 17 and Tomcat 10 or Jetty 11. Commercial support is available from VMware.
98
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
