Spring Security 6 & JWT Authentication · Lección

Configuración de un cliente OAuth2

Configure su aplicación para actuar como cliente OAuth2 y defina los datos de registro de varios proveedores.

Configuración de un cliente OAuth2 es una lección gratuita de Spring Security 6 & JWT Authentication en CoddyKit. Esta es la lección 1 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Spring Security 6 & JWT Authentication, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

What is an OAuth2 Client?

In OAuth2, an OAuth2 Client is an application that wants to access resources on behalf of a user from a Resource Server. Think of it as your app asking permission to use another service (like Google or GitHub) on your behalf.

It's not the user, but an application acting for the user.

Why Configure Our App?

To use an external service's API (e.g., getting user profiles, posting updates), your application needs to be recognized by that service. This recognition process is called client registration.

Your app gets a unique identity.
The service knows who is requesting access.
It enables secure communication and authorization.

Key Client Registration Details

When you register your application with an OAuth2 Authorization Server (the service that grants access), you'll typically provide and receive:

Client ID: A public identifier for your application.
Client Secret: A confidential key used to authenticate your app.
Redirect URI(s): Where the Authorization Server sends the user back after authorization.

Spring Security as an OAuth2 Client

Spring Security makes it incredibly easy to configure your Spring Boot application to act as an OAuth2 Client. It handles much of the complex OAuth2 flow automatically.

All you need to do is provide the necessary registration details for the external service you want to connect to.

Client Configuration File

Spring Security's OAuth2 client configuration lives primarily in your application.yml or application.properties file.

You'll use two main prefixes:

spring.security.oauth2.client.registration: Defines details about your app's registration with a specific provider.
spring.security.oauth2.client.provider: Defines details about the OAuth2 provider itself (e.g., its authorization endpoint).

Setting Up a Provider

Under spring.security.oauth2.client.provider.[provider-name], you define the endpoints of the external OAuth2 service. For example, for a provider named github:

authorization-uri: Where users go to authorize your app.
token-uri: Where your app exchanges codes for tokens.
user-info-uri: Where your app fetches user details.

Often, Spring Boot can auto-configure these for popular providers if you just provide the client-id and client-secret.

Registering Your Client App

Under spring.security.oauth2.client.registration.[registration-id], you specify your app's unique registration details for a given provider. The registration-id acts as a unique name for your specific client configuration.

provider: Links to a defined provider (e.g., github).
client-id: Your app's public ID.
client-secret: Your app's secret key.
redirect-uri: The callback URL.
scope: Permissions your app requests (e.g., read:user).
authorization-grant-type: The OAuth2 flow used (e.g., authorization_code).

Example: GitHub Client Setup

Let's look at a concrete example using GitHub. You would first register your application on GitHub's developer settings to get a Client ID and Client Secret.

Then, configure your application.yml:

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            client-id: your-github-client-id
            client-secret: your-github-client-secret
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: read:user,user:email
        provider:
          github:
            authorization-uri: https://github.com/login/oauth/authorize
            token-uri: https://github.com/login/oauth/access_token
            user-info-uri: https://api.github.com/user

Minimal Spring Boot App

To enable OAuth2 client functionality, ensure you have the spring-boot-starter-oauth2-client dependency. Spring Boot will automatically detect the configuration and set up the necessary filters.

Here's a basic Spring Boot application entry point:

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import java.security.Principal;

@SpringBootApplication
@RestController
public class Oauth2ClientApp {

    public static void main(String[] args) {
        SpringApplication.run(Oauth2ClientApp.class, args);
    }

    @GetMapping("/")
    public String welcome(Principal principal) {
        if (principal != null) {
            return "Hello, " + principal.getName() + "! You are logged in with OAuth2.";
        }
        return "Hello! Please log in with OAuth2.";
    }
}

The Automated OAuth2 Flow

Once configured, Spring Security automatically:

Redirects unauthenticated users to the configured Authorization Server's login page.
Handles the authorization code exchange after the user grants permission.
Fetches user details from the user-info-uri.
Populates the SecurityContext with the authenticated user.

This significantly simplifies implementing OAuth2 client logic.

Quick Check: Client Config

You're setting up a Spring Boot application to act as an OAuth2 client for an external service. Which of the following properties is primarily used to identify your application to the external service, and should be kept confidential?

Recap: OAuth2 Client Setup

You've learned how to configure your Spring Boot application as an OAuth2 Client. We covered:

The role of an OAuth2 Client.
Key configuration properties like client-id and client-secret.
How to use application.yml for client and provider registration.
Spring Security's automatic handling of the OAuth2 flow.

Next, we'll dive into integrating specific social login providers like Google and GitHub in more detail!

Preguntas frecuentes

¿La lección «Configuración de un cliente OAuth2» es gratis?

Sí — el texto completo de «Configuración de un cliente OAuth2» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Spring Security 6 & JWT Authentication, actualiza a CoddyKit PRO. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

¿Qué aprenderé en «Configuración de un cliente OAuth2»?

Configure su aplicación para actuar como cliente OAuth2 y defina los datos de registro de varios proveedores. Practicas Spring Security 6 & JWT Authentication con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar Spring Security 6 & JWT Authentication?

No se requiere experiencia previa. Spring Security 6 & JWT Authentication en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 1 de 4.

¿Cuánto tiempo toma la lección «Configuración de un cliente OAuth2»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de Spring Security 6 & JWT Authentication?

Sí. Cada lección de Spring Security 6 & JWT Authentication incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

← Volver a Spring Security 6 & JWT Authentication