Okta in Spring Boot implementation with Spring Security and oauth2 | LIVE DEMO | Code Decode

In this example we have explained Okta Spring boot with oauth2 and Spring Security.
Udemy Course of Code Decode on Microservice k8s AWS CICD link:
openinapp.co/u...
Course Description Video :
yt.openinapp.c...
Next Level App download link : next-level.one...
Create an Account in Okta
Login / Register to developer.okta...
Okta is our - Authorization server. It will provide us Access token to access our secured APIs.
Okta internally uses Oauth2.0 as underlying protocol for security implementation.
Okta provides a pre-configured custom authorization server called default.
You can register or login with Google / Github etc.
After successful registration , Next you need to create an application
Click on 3 lines in top left corner there u can see application dropdown
Click on applications
Then click on Create App Integration and choose the type of authorization method you want to use.
We need API Services
Interact with Okta APIs using the scoped OAuth 2.0 access tokens for machine-to-machine authentication.
Name your application
After that remember to save imp information - such as client credentials, client secrets, and Okta domain id that will be used later for our application
Client Id = Our public identifier to the OAuth flows.
Secret Id = Password for the client ID.
Okta Domain ID = The ID of the organization where our application is located.
Next Go to the Security tab and click on the API section
Here we have the following properties: authorization server name, audience, and issuer URI.
Audience = the claim aud to identify the recipient that the JWT is intended for.
Authorization server name = the name of the authorization server. In this case, I’m using the default one, but you can also create your own authorization server with the proper policies, scope, and claims.
Issuer URL is a unique identifier and a point to provide important metadata about the server, including a request for a token by adding the /v1/token path.
Create Spring Boot Application
Create a Spring boot project
Add Okta starter dependency - okta-spring-boot-starter - This will add all required classes for securing Spring application
Now we need to configure the API, adding some properties to our application.yml.
Now if you try to run Application - it will create error - Your Okta Issuer URL is missing. You can copy your domain from the Okta Developer Console
okta:
oauth2:
issuer: ${yourDomainId}/oauth2/default
Now after Securing the Application. Create any controller and rest endpoint.
Secure your Spring Boot Application
You will not be able to access the Get request also with okta implemented
To Test your application now - Try hitting through postman and u can see 401 - unauthorised
Create Custom scope as “ custom “ in okta.
use it to get token and use that token in apis.
In order for someone to make a request to your API, they need an access token. How an access token is obtained depends on the client making the request
Most Asked Core Java Interview Questions and Answers: • Core Java frequently a...
Advance Java Interview Questions and Answers: • Advance Java Interview...
Java 8 Interview Questions and Answers: • Java 8 Interview Quest...
Hibernate Interview Questions and Answers:
• Hibernate Interview Qu...
Spring Boot Interview Questions and Answers:
• Advance Java Interview...
Angular Playlist: • Angular Course Introdu...
SQL Playlist: • SQL Interview Question...
GIT: • GIT
Subscriber and Follow Code Decode
Subscriber Code Decode: www.youtube.co...
LinkedIn : / codedecodeyoutube
Instagram: / codedecode25
#okta#springsecurity #codedecode

[@Trishaptesh]

I have started preparing for job interviews and following all the videos you uploaded in this channel from past fews day. I must say you did a great job here. Thank you for all the hardwork you are putting and keep sharing your valuable knowledge with us. Thanks.

[@CodeDecode]

Means a lot to us 🙏🙏. Keep learning keep shining Man 🌟🌟🌟🌟

[@RavikiranKada-e9p]

One of the best videos on OAuth 2.0 I have come across. Thank infinitely

[@CodeDecode]

Thank you so much

[@shalinisharma8122]

Great explanation and in depth coverage of the topic. May GOD bless you. Doing a great job.

[@CodeDecode]

Thanks Shalini 🙂👍

[@gayatrimamidwar8364]

I was looking for okta nd understood from beginning to end. Thanks a lot dear🥰.. learning a lot from your videos

[@CodeDecode]

Glad to hear that Gayatri 😊👍

[@vuttianusha5540]

Yet another great video!! I have been following your videos and content. It's been amazing. Thank you soo much for your time and effort. Please upload the next part of this that is securing only post apis and not get apis.

[@CodeDecode]

Sure 👍Thanks 👍

[@ashishshriwatri9]

I feel like CODE DECODE become university. Thank You.

[@CodeDecode]

Thanks Ashish 😊👍

[@bavana541]

Excellent video.. really appreciate your efforts to explain in detailed manner ..its very clear so that fresher can also learn without any difficulty..god bless you sister.

[@CodeDecode]

Thanks for the motivation bavana

[@timtim9o5]

Thank you! To me this was a lot more straight-forward than keycloak, and you explained it very clearly.

[@CodeDecode]

Thanks 😊👍

[@nishantlakhara]

you are a time saver. very clear and crisp explanation.

[@CodeDecode]

Thanks 🙏🙏👍👍

[@robinbhargava111]

Very informative video to learn about Okta and token generation.

[@CodeDecode]

Thanks Robin 😊

[@jagan1957]

Thank you so much for the amazing insights into the profiles.... Highly helpful and educative. Keep creating more content.

[@manishkartik1275]

Hello Maam your lectures helped me a lot to crack big tech companies interview round Thanks a lot for this can you please do a session for MYBatis also

[@deeptyrajput8343]

Thanks for the video. Please upload further videos related to security configuration and all.

[@pratikkurbet3437]

Just watching Okta content and your popped up thanks 🙏

[@CodeDecode]

Thanks Pratik 🙂🙂👍

[@subbu.kurapati3575]

Excellent content video. Please provide continution madam🥰👌👌

[@CodeDecode]

Thank :)

[@Vithal_Nivargi]

Thanks mam nicely explained 🙏. and please bring other videos on this concept like custom configuration. and implement such way that we can use it in Enterprise application level. Thanks

[@CodeDecode]

Sure we will do that👍👍🙂

[@swapnilchavhan480]

Thank you very well explained in short video ,please make details series about security

[@CodeDecode]

Sure Swapnil 👍

[@veera-fb9or]

Wow Great Explination 👍👍👍👍👍👍

[@praveens2272]

Indian youtubers are on direct point

[@CodeDecode]

Thanks

[@tanson86]

Yes. I want a video on the implementation you referred to in the last 1 minute ie integrating okta with webszcurtiyconfigureadapter and ant matchers for bypassing certain end points.

[@CodeDecode]

Sure Tanson 👍👍

[@thepowerofanime4619]

Good video. I am jot sure if u will make the next part of it.

[@misjmadura]

Your contents are amazing and so useful. I have been watching them recently and learning so much from you. Really Appreciate your efforts. Could you please share the link of next part of this video if it is uploaded? Thank you again.

[@aishurajas2507]

Hi code decode member, I really want to learn from you. Do you conduct offline trainings?

[@VishnuVardhan-pe7lj]

Hey!!!! Your way of presenting is too good.

[@CodeDecode]

Thanks Vishnu 🙂🙂

[@RjDBIIPL]

i learned a lot from you ,tqsm🌹

[@CodeDecode]

I'm so glad! ❤️

[@farhaankazi7134]

Please make more video on okta authentication and authorization for microservices communication including api gateway

[@CodeDecode]

Sure 👍

[@oldaccount137]

Very useful video as always , but one thing i want to know that how the internals of these works in spring application which filter , AuthenticationManager , provider are getting used to authorize client and storing Authenticated Objects if these things you explain in the next video will be awesome and will be next level of knowledge.❤️❤️❤️

[@CodeDecode]

Sure we will do that 👍👍

[@soulfulGirl_]

@@CodeDecode Is this video available , if so can you pleaseee share it will be very helpful

[@sudheerkumar-tp1mg]

Hi Mam, I am big fan of your channel, regarding SSO how to modify the already existing backend system because that systems already have user information which internally used in different parts of the application, please share any video on this.

[@souravpaul6086]

Hi, your videos are so informative I learned a lot from your videos thank you for making informative videos for us. I have a request could you please make a video where linkedin and twitter used as social login platform instead of okta that can be very useful. Please make a video on this topic

[@sanjayshah3538]

Thank its very helpful knowledge, may i know how can we define in controller the. Specific endpoint can be access by scope(roles) which based while creating token, could you help me that to implement please.

[@CodeDecode]

We will create video on that soon👍

[@anjaniysalekar6727]

Love your content madam, love from Gujarat😊. Please make a same video with Keycloak too. Please make that video.

[@CodeDecode]

Sure Anjaniy 😃😃🙂👍

[@anjaniysalekar6727]

@@CodeDecode thanks in advanced.

[@siddharthpandey835]

Seriously Its awesome. Pls make more videos !!!!!!!!

[@CodeDecode]

Thanks Siddharth 🙂🙂👍👍

[@sriharshapaladugu3575]

HI Nice explanation I have two questions: How can i have okta validation without "/okta" in url? How to extract user information and pass it to different function from jwt?

[@Shreenidhi110]

just wow!,Excelent content,Thanks alot !

[@rakeshpramanik]

Thank you for all hard work .plz make an extension

[@CodeDecode]

Thanks . Sure Rakesh 👍👍

[@mediss3720]

Good exercice for okta jwt

[@CodeDecode]

thanks

[@sandysworld7529]

First comment and first like.. i waiting for this.. thank you mam

[@CodeDecode]

Thanks a lot🙂👍👍😃

[@aasthasharma8593]

Very well explained!! Thanks to good video

[@CodeDecode]

Thanks Aastha ❤️

[@vickybhoir3017]

nice explanation

[@baskar.k]

Very good tutorial

[@CodeDecode]

Thanks

[@saikiran3085]

Thank you so much

[@CodeDecode]

You're most welcome

[@AnjaliPatel-b8r]

Can you create a demo with new authorization server please?

[@monishad7040]

Thank you for your efforts and I am getting 404 error. { "error": "invalid_dpop_proof", "error_description": "The DPoP proof JWT header is missing." } Could you please help me.

[@albertraja7449]

Getting same error

[@SoyJavero]

same could you solve it?

[@agrawalparimal7283]

​@@SoyJavero that's because you must have selected Proof of Possession while creating an app, you can modify it, it will be below client secrets in general settings, so uncheck it!

[@everyone2905]

Please attach a link in the comments of Single sign on, which you said you'll discuss in next video, i can't find by searching on your channel.

[@dasithasandaruwan6002]

Hope you will do the user registration part too, thanks

[@CodeDecode]

User registration part? Can u plz elaborate?

[@WHITE-ci5mv]

Hi, I follow the steps in the video but while generating the token using postman i am getting below error: "error": "unsupported_grant_type", "error_description": "The authorization grant type is not supported by the authorization server. Configured grant types: [client_credentials]." what could be issue here?

[@mahendragoud8406]

Hello mam Currently its showing error at 16:22 The DPoP proof JWT header is missing please provide a way to resolve this

[@SoyJavero]

same could you solve it?

[@agrawalparimal7283]

that's because you must have selected Proof of Possession while creating an app, you can modify it, it will be below client secrets in general settings, so uncheck it!

[@ahammedhussain9335]

Can we have a securityconfig class video please ?

[@pottendlanagma7263]

In recent time DPoP came into picture for JWT token and this example is not working. i am getting "invalid_dpop_proof" error. It would be great if you could make a video about this issue.

[@SoyJavero]

same could you solve it?

[@agrawalparimal7283]

that's because you must have selected Proof of Possession while creating an app, you can modify it, it will be below client secrets in general settings, so uncheck it!

[@RjDBIIPL]

do you have a oauth2 with okta ODIC-openID web application without postman API, please post asap

[@CodeDecode]

What do you require exactly? Spring boot application?

[@astar4782]

The Okta UI has changed.. can you show a sample with the latest UI ?

[@CodeDecode]

Sure👍

[@hassanharera]

Great

[@CodeDecode]

Thanks😇

[@omkarmhatre628]

Grate Video mam. Please make extension of this video. Thank you.

[@CodeDecode]

sure omkar we will create it soon

[@crazyajay9289]

do we have the extension of this video series?

[@DattatrayBabar-w2e]

@codedecode The DPoP proof JWT header is missing. I'm getting this while generating token

[@SoyJavero]

same could you solve it?

[@agrawalparimal7283]

that's because you must have selected Proof of Possession while creating an app, you can modify it, it will be below client secrets in general settings, so uncheck it!

[@Varun-v8g]

Please create more content on oauth

[@CodeDecode]

Sure we will create it soon

[@ujjwalmittal3122]

MORE VIDEO ON THIS PLEASE

[@CodeDecode]

Sure ujjwal we will create it soon

[@ujjwalmittal3122]

Thank you Mam

[@a.m.jyotiprakashsahu5754]

plz make one more video on okta..

[@CodeDecode]

Sure 👍👍

[@you_shotzz]

Can u show the role based also OIDC one

[@vikashkumar-gv1dp]

🙏🙏🙏please upload one video for authorization_code as grant type🙏🙏🙏

[@veera-fb9or]

U Have any github account

[@vempallireddybasha1302]

pls do customization auth server as well mam

[@anithaluckas2635]

Can you please explain and upload the spring batch

[@siddapure]

I have created application in same way you explained but it's not working

[@CodeDecode]

Issue?

[@siddapure]

I have configured all as you told and getting torn from jwt token as well. When I pass this token as basic with JWT and passed credentials etc. But getting 401 from postman when I hit my application. Am I Missing anything?

[@DattatrayBabar-w2e]

{ "error": "invalid_dpop_proof", "error_description": "The DPoP proof JWT header is missing." } what can be done in this case, while generating token

[@SoyJavero]

same could you solve it?

[@agrawalparimal7283]

that's because you must have selected Proof of Possession while creating an app, you can modify it, it will be below client secrets in general settings, so uncheck it!

[@prisinha]

6:00 Yes please create

[@gauravjaiswal7923]

Can you please create the second part of this

[@CodeDecode]

Sure Gaurav 👍

[@SajidhKareem]

@@CodeDecode Yes pls. I need it desperately.

[@funnyvideorocks]

Can you please solve leetcode with basic logic

[@CodeDecode]

Sure we are already uploading many such videos on channel

[@mohamednibras53]

How to get access token for a specifc user ?

[@CodeDecode]

Access tokens have claims. Claims have user info. From front end get access token signing that specific user, you will then get all user info in your token itself

[@mohamednibras53]

@@CodeDecode in this video to get the access token you have passed username and password as client id and client secret. I have 5 users in the Okta directory. When i try to get access token by passing those users credentials, i cannot get access token. How to resolve this ?

[@Shreenidhi110]

Please add the next video

[@pillisasidharreddy8632]

We want part2 of okta

[@tamojitdutta993]

Pls create the next video for okta

[@CodeDecode]

Sure 👍👍

[@sandysworld7529]

Mam, please make extension of this video.. Thanks.

[@CodeDecode]

Sure 👍👍

[@manishkartik1275]

14:20 you will cry why you are not getting access token 🤣🤣

[@shaikvaheed1730]

I tried the same way what tou did for my project POC am getting the below error couldn't retrieve remote JWK set PKIX path building failed sun.security.certpath.suncertpathbuilderexception Please suggest what can be done for this issue

[@BeAmbitious96]

Im getting below error { "error": "invalid_dpop_proof", "error_description": "The DPoP proof JWT header is missing." }

[@SoyJavero]

same could you solve it?

[@agrawalparimal7283]

that's because you must have selected Proof of Possession while creating an app, you can modify it, it will be below client secrets in general settings, so uncheck it!