317 questions
-4 votes
0 answers
41 views
Performance issue with oauth2_authorization table at scale - BLOB column without index [closed]
I'm running Spring Authorization Server in production with MySQL 8.4 on AWS RDS. Our oauth2_authorization table has accumulated around 600,000 records, and we're experiencing significant performance ...
Best practices
0 votes
1 replies
29 views
SpringC loud Gateway and Spring Authorisation Server Common Session storage
I have a Spring Authorisation Server as my OAuth2-OpenID Connect authentication server running with multiple instances on a cluster. It uses Spring Session Redis for managing distributed sessions. ...
0 votes
0 answers
101 views
How to implement non-plain-text password transmission in Spring Authorization Server 1.4.3 (password grant extension)
I’m using Spring Authorization Server 1.4.3 to build an authentication center. I’ve extended the authorization server to support the password grant type, so clients can obtain access tokens via the /...
0 votes
1 answer
50 views
how to save the client-id from request cache when a user is redirected to the spring authorization server?
I have implemented or extended on top of Spring Authorization server. I have a authentication controller that accesses the client-id from the RequestCache object. Now, I have built a sample OAuth app ...
0 votes
0 answers
36 views
Does Spring Authorization supports FAPI 2.0
I'm trying to do a PoC on FAPI 2.0 for which I want to have an authorization server that supports FAPI2.0 along with the control over IDP integration, user database, OIDC provider and onboarding third ...
0 votes
0 answers
74 views
Spring OAuth2 login page doesn’t load correctly when accessed through Gateway
I’m using a Spring OAuth2 Authorization Server with a Gateway in front of it. When I access the login page directly via http://localhost:9999 (the OAuth2 server port), everything works: the CSS loads ...
0 votes
1 answer
97 views
Spring OAuth2 Authorization Server: IllegalArgumentException when deserializing custom User class after consent approval
I'm trying to set up a Spring Authorization Server for learning purposes. The login and consent screens work, but after I approve the consent screen and submit the /authorize request, I get the ...
0 votes
1 answer
79 views
Where should roles and missions/ACLs be managed when building an authorization server?
I’m trying to build my own Spring Authorization Server (for learning purposes and possibly to use across multiple projects in the future). I’m already familiar with Spring Security and resource server ...
0 votes
0 answers
69 views
Avoid uri='UNKNOWN' for OAuth endpoints in Spring Authorization Server
I'm using Spring Authorization Server together with Spring Boot Actuator and Micrometer Prometheus integration. For metrics like http_server_requests_seconds_count, I’m seeing many uri="UNKNOWN&...
0 votes
0 answers
76 views
Oauth2 Logout fails when the token is refreshed using the refresh token. message: Logout request failed: [invalid_token] id_token_hint
alright gpt did not help with this one. so my problem is that logout fails when the token has been refreshed using the refresh token. spring auth server says id_token_hint has expired because it's ...
0 votes
0 answers
39 views
Best way to extend RegisteredClient to support a custom field (app_id) in dynamic client registration?
I'm using Spring Authorization Server with JDBC and dynamic client registration. I want to extend RegisteredClient to support a custom field called app_id. This value is provided in the dynamic ...
0 votes
1 answer
112 views
Spring Authorization Server ~ How to unregister default AuthenticationProviders
I am trying to implement OAuth2 authentication for an App in a Spring Boot backend using Spring Authorization Server. My problem is that I have custom logic that uses its own AuthenticationProviders, ...
0 votes
0 answers
31 views
Spring Authorization Server - Authorizing Requests Using Established Spring Security Functionalities Not Possible?
I am trying to use Spring Authorization Server as such: My application is providing a OIDC Provider endpoint such that it works as an authorization server for third parties (e.g. Zitadel) But only ...
1 vote
1 answer
81 views
How to log client information upon successful client credentials flow is performed in Spring Boot Authorization Server
I want to log RegisteredClient.clientId, RegisteredClient.clientName when it performs successful client credentials flow. How can I achieve this? Current Behavior I checked logs (with TRACE level) ...
-1 votes
1 answer
65 views
Can't set Allow Origin Header on response header
i'm learing to Spring oauth2 Client and Spring authorization server and I faced such a problem that I can not set the header on the redirect request from the gateway to the authorization server. Cors ...