Implementing OAuth2 with Spring Security: A Step-by-Step Guide

OAuth2 is an authorization framework that enables secure and limited access to user resources on HTTP services like Google, GitHub, or Facebook. It allows users to authorize third-party applications to access their data without revealing their credentials.

This guide walks you through integrating OAuth2 with Spring Boot and Spring Security to enable secure login and access through OAuth2 providers such as Google.

What is OAuth2?

OAuth2 (Open Authorization 2.0) is a framework that allows applications to access user data hosted on external services without requiring users to share their passwords. Instead, users authorize access via tokens issued by the service provider.

Key Components of OAuth2

• Resource Owner: The user who grants access to their data.
• Client: The application requesting access to the user’s account.
• Authorization Server: The server that authenticates the user and issues access tokens.
• Resource Server: The server that hosts the protected resources and validates access tokens.

OAuth2 Authorization Flows

OAuth2 defines multiple flows depending on the type of application:

• Authorization Code Grant: Commonly used for server-side applications. The client receives an authorization code, then exchanges it for an access token.
• Implicit Grant: Used for client-side (browser-based) applications where the access token is returned directly without a code exchange.
• Resource Owner Password Credentials Grant: Used when the client can directly request credentials from the resource owner (trusted applications only).
• Client Credentials Grant: Used when a client accesses its own resources instead of a user’s.

Prerequisites:

• Good understanding of Spring Boot and Spring Security
• JDK 17 installed
• IntelliJ IDEA or any IDE
• Google Cloud Console account (for OAuth client setup)
• Maven for dependency management

Implementation Steps

Step 1: Create a New Spring Boot Project

Create a Spring Boot project with the following options:

• Project Name: oauth2-spring-security
• Language: Java
• Type: Maven
• Packaging: Jar

Step 2: Add the Dependencies

Add the following dependencies in the pom.xml:

After creating the project, the folder structure in the IDE will be like below image:

Step 3: Configure application.properties

Add the following Google OAuth2 configuration:

spring.application.name=oauth2-spring-security

spring.security.oauth2.client.registration.google.client-id=YOUR_GOOGLE_CLIENT_ID

spring.security.oauth2.client.registration.google.client-secret=YOUR_GOOGLE_CLIENT_SECRET

spring.security.oauth2.client.registration.google.redirect-uri=http://localhost:8080/login/oauth2/code/{registrationId}

spring.security.oauth2.client.registration.google.scope=profile,email

Step 4: Create the User Model

User.java:

This class defines a user with name and email fields and uses Lombok for boilerplate reduction.

Step 5: Create the Service Class

This service class is responsible for creating User objects from OAuth2User data.

UserService.java:

This service converts OAuth2 user data into a local User object.

Step 6: Configure Spring Security

SecurityConfig.java:

This configuration secures all routes except / and /login and sets up OAuth2 login.

Step 7: Create the Controller

HomeController.java:

The controller handles login and home routes, displaying the user’s name after authentication.

Step 8: Main Application Class

No changes are required in the main class.

This is the entry point for the Spring Boot application.

Step 9: Create the Login Page

This HTML file contains the structure and styles for the login page. It includes a button to initiate the OAuth2 login with Google.

Go to src > main > resources > templates > login.html and put the below HTML code.

Step 10: Create the Home HTML File

This HTML file displays the home page after successful login.

Go to src > main > resources > templates > home.html and put the below HTML code.

Step 11: Run the application

Step 12: Testing the Application

To test the OAuth2 login, navigate to the following URLs in your web browser:

Login Page:

http://localhost:8080/login

Output:

Google OAuth Authentication:

Home Page:

http://localhost:8080/home

Output:

You will see the login page, followed by the Google OAuth2 authentication process. Upon successful login, you will be redirected to the home page with a personalized welcome message.

Benefits of using OAuth2

• Security: Applications can access user data without exposing credentials.
• User Experience: Users can log in using trusted providers like Google or GitHub.
• Scalability: Supports multiple flows suited for different architectures.
• Interoperability: Widely adopted standard that integrates with various platforms.