{"id":94444,"date":"2019-07-22T13:00:06","date_gmt":"2019-07-22T10:00:06","guid":{"rendered":"http:\/\/www.javacodegeeks.com\/?p=94444"},"modified":"2019-07-29T09:08:02","modified_gmt":"2019-07-29T06:08:02","slug":"simple-authentication-spring-security","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2019\/07\/simple-authentication-spring-security.html","title":{"rendered":"Simple Authentication with Spring Security"},"content":{"rendered":"

Friends don\u2019t let friends write user auth. Tired of managing your own users?<\/strong> Try Okta\u2019s API and Java SDKs today. Authenticate, manage, and secure users in any application within minutes.<\/a><\/p>\n

Authentication is vital to all but the most basic web applications. Who is making the request, wanting data, or wanting to update or delete data? Can you be sure that the request is coming from the stated user or agent? Answering this question with certainty is hard in today\u2019s computer security environment. Fortunately, there is absolutely no reason to reinvent the wheel.<\/p>\n

Spring Boot with Spring Security is a powerful combination for web application development. With relatively few lines of code, you can implement a variety of authentication systems. These systems are tested, updated, and implemented according to specifications by experts.<\/p>\n

In this tutorial, you are going to build a very simple Spring Boot app that starts with basic-auth and progresses through form-based authentication, custom form-based authentication, and OAuth 2.0 \/ OpenID Connect using Okta as the OAuth provider. We will also look at SAML auth. The Spring Security SAML implementation, however, is currently in transition and not updated to the most current version of Spring Boot.<\/p>\n

This tutorial looks specifically at authentication, leaving authorization for another day. Authentication answers the question: who is making the request. Authorization comes after authentication and answers the question: is the authenticated user allowed to make the specific request?<\/p>\n

Requirements and Assumptions for Authentication with Spring Security<\/h2>\n

This tutorial assumes a basic familiarity with Java and Spring Boot. The project utilizes the Gradle build system (because I find Groovy DSL endlessly preferable to XML). You do not need Gradle installed, however, since all projects include the Gradle wrapper.<\/p>\n

You do not need a comprehensive understanding of OAuth 2.0 and OpenID Connect (OIDC) – thankfully, because it\u2019s complex, detailed, and sprawling at times. I\u2019m still working to understand many aspects of it. However, a basic understanding would be helpful. If you want to go deeper, there are some links at the end of the article that can help you.<\/p>\n

Very (very) briefly, OAuth 2.0 is the second major version of Open Authorization, an open-source authorization specification. From the OAuth spec committee<\/a>: \u201cOAuth 2.0 focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices.\u201d Notice two things: 1) it\u2019s authorization only, so no authentication; and 2) it\u2019s a specification, so there\u2019s no implementation. OIDC builds on top of OAuth 2.0 to add an identity layer (authentication) using a well-defined token.<\/p>\n

Spring Security Authentication with Okta<\/h2>\n

Okta is an identity access and management company that provides a whole host of software-as-service identity products. We have an implementation of OAuth 2.0 and OpenID Connect that makes adding single sign-on (SSO) to a Spring Boot app easy.<\/p>\n

Our API enables you to:<\/p>\n