Spring Security OAuth2 clientId and clientSecret -
i evaluating spring security oauth2 implementation. confused clientid , clientsecret.
i follow https://spring.io/guides/tutorials/spring-security-and-angular-js/ build auth server.
i can generate code
http://localhost:9999/uaa/oauth/authorize?response_type=code&client_id=acme&redirect_uri=http://example.com i can obtain accesstoken by
curl acme:acmesecret@localhost:9999/uaa/oauth/token \ -d grant_type=authorization_code -d client_id=acme \ -d redirect_uri=http://example.com -d code=jywioi {"access_token":"2219199c-966e-4466-8b7e-12bb9038c9bb","token_type":"bearer","refresh_token":"d193caf4-5643-4988-9a4a-1c03c9d657aa","expires_in":43199,"scope":"openid"} when getting access token, clientid , clientsecret required.
but if have multiple clients, should start multiple auth server? cannot work in way.
how build oauth2 server without clientid , clientsecret?
the code here: https://github.com/yigubigu/spring-security-auth
you can setup may clients
ex in memory :-
public void configure(clientdetailsserviceconfigurer clients) throws exception { clients.inmemory() .withclient("acme") .secret("acmesecret") .authorizedgranttypes("authorization_code", "refresh_token", "password").scopes("openid") .and() .withclient("xx") .secret("xx") .authorizedgranttypes("xxx"); } or can add database record client
ref - spring oauth2 db schema
Comments
Post a Comment