Spring Security 6 & JWT Authentication · レッスン

OAuth2クライアントのセットアップ

アプリケーションをOAuth2クライアントとして動作させるため、さまざまなプロバイダーの登録情報を設定します。

「OAuth2クライアントのセットアップ」はCoddyKit上の無料Spring Security 6 & JWT Authenticationレッスンです。これはレッスン1/4です。下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。これはSpring Security 6 & JWT Authentication学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Spring Security 6 & JWT Authenticationコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

What is an OAuth2 Client?

In OAuth2, an OAuth2 Client is an application that wants to access resources on behalf of a user from a Resource Server. Think of it as your app asking permission to use another service (like Google or GitHub) on your behalf.

It's not the user, but an application acting for the user.

Why Configure Our App?

To use an external service's API (e.g., getting user profiles, posting updates), your application needs to be recognized by that service. This recognition process is called client registration.

Your app gets a unique identity.
The service knows who is requesting access.
It enables secure communication and authorization.

Key Client Registration Details

When you register your application with an OAuth2 Authorization Server (the service that grants access), you'll typically provide and receive:

Client ID: A public identifier for your application.
Client Secret: A confidential key used to authenticate your app.
Redirect URI(s): Where the Authorization Server sends the user back after authorization.

Spring Security as an OAuth2 Client

Spring Security makes it incredibly easy to configure your Spring Boot application to act as an OAuth2 Client. It handles much of the complex OAuth2 flow automatically.

All you need to do is provide the necessary registration details for the external service you want to connect to.

Client Configuration File

Spring Security's OAuth2 client configuration lives primarily in your application.yml or application.properties file.

You'll use two main prefixes:

spring.security.oauth2.client.registration: Defines details about your app's registration with a specific provider.
spring.security.oauth2.client.provider: Defines details about the OAuth2 provider itself (e.g., its authorization endpoint).

Setting Up a Provider

Under spring.security.oauth2.client.provider.[provider-name], you define the endpoints of the external OAuth2 service. For example, for a provider named github:

authorization-uri: Where users go to authorize your app.
token-uri: Where your app exchanges codes for tokens.
user-info-uri: Where your app fetches user details.

Often, Spring Boot can auto-configure these for popular providers if you just provide the client-id and client-secret.

Registering Your Client App

Under spring.security.oauth2.client.registration.[registration-id], you specify your app's unique registration details for a given provider. The registration-id acts as a unique name for your specific client configuration.

provider: Links to a defined provider (e.g., github).
client-id: Your app's public ID.
client-secret: Your app's secret key.
redirect-uri: The callback URL.
scope: Permissions your app requests (e.g., read:user).
authorization-grant-type: The OAuth2 flow used (e.g., authorization_code).

Example: GitHub Client Setup

Let's look at a concrete example using GitHub. You would first register your application on GitHub's developer settings to get a Client ID and Client Secret.

Then, configure your application.yml:

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            client-id: your-github-client-id
            client-secret: your-github-client-secret
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope: read:user,user:email
        provider:
          github:
            authorization-uri: https://github.com/login/oauth/authorize
            token-uri: https://github.com/login/oauth/access_token
            user-info-uri: https://api.github.com/user

Minimal Spring Boot App

To enable OAuth2 client functionality, ensure you have the spring-boot-starter-oauth2-client dependency. Spring Boot will automatically detect the configuration and set up the necessary filters.

Here's a basic Spring Boot application entry point:

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import java.security.Principal;

@SpringBootApplication
@RestController
public class Oauth2ClientApp {

    public static void main(String[] args) {
        SpringApplication.run(Oauth2ClientApp.class, args);
    }

    @GetMapping("/")
    public String welcome(Principal principal) {
        if (principal != null) {
            return "Hello, " + principal.getName() + "! You are logged in with OAuth2.";
        }
        return "Hello! Please log in with OAuth2.";
    }
}

The Automated OAuth2 Flow

Once configured, Spring Security automatically:

Redirects unauthenticated users to the configured Authorization Server's login page.
Handles the authorization code exchange after the user grants permission.
Fetches user details from the user-info-uri.
Populates the SecurityContext with the authenticated user.

This significantly simplifies implementing OAuth2 client logic.

Quick Check: Client Config

You're setting up a Spring Boot application to act as an OAuth2 client for an external service. Which of the following properties is primarily used to identify your application to the external service, and should be kept confidential?

Recap: OAuth2 Client Setup

You've learned how to configure your Spring Boot application as an OAuth2 Client. We covered:

The role of an OAuth2 Client.
Key configuration properties like client-id and client-secret.
How to use application.yml for client and provider registration.
Spring Security's automatic handling of the OAuth2 flow.

Next, we'll dive into integrating specific social login providers like Google and GitHub in more detail!

よくある質問

「OAuth2クライアントのセットアップ」レッスンは無料ですか？

はい。「OAuth2クライアントのセットアップ」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Spring Security 6 & JWT Authenticationコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Spring Security 6 & JWT Authenticationコースには全4レッスンが含まれています。

「OAuth2クライアントのセットアップ」で何を学びますか？

アプリケーションをOAuth2クライアントとして動作させるため、さまざまなプロバイダーの登録情報を設定します。ブラウザで直接実行するハンズオンコードでSpring Security 6 & JWT Authenticationを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

Spring Security 6 & JWT Authenticationを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのSpring Security 6 & JWT Authenticationは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。これはレッスン1/4です。

「OAuth2クライアントのセットアップ」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このSpring Security 6 & JWT Authenticationレッスンでコードを書いて実行できますか？

はい。すべてのSpring Security 6 & JWT Authenticationレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

← Spring Security 6 & JWT Authenticationに戻る