Spring Security - OAuth2 Example Using GitHub | SpringBoot | Java Techie

This video explain you how to use Spring Security OAuth2 using GitHub as Resource server | Spring Boot | Spring cloud security
#Javatechie #OAuth2 #SpringBoot
GitHub:
github.com/Jav...
Blogs:
javagyanmantra...
Facebook:
/ 919464521471923
Music: City_of_Jewels
guys if you like this video please do subscribe now and press the bell icon to not miss any update from Java Techie
Disclaimer/Policy:
--------------------------------
Note : All uploaded content in this channel is mine and its not copied from any community , you are free to use source code from above mentioned GitHub account

[@ahmedjimale4261]

Because of you @Java techie i passed last semester and on my way to pass this semester. Thanks a lot

[@Javatechie]

Glad to hear this 😊

[@grandselenium296]

4:16 out of all explanations I've read, this right here is the best

[@sudheerkumar-tp1mg]

Basant sir is great helping lot of IT employees

[@prithvik8448]

No one can explained like this. Great job very clean 👌 I got both theoritical and practical knowledge

[@01cybrain]

Excellent explaination ., Awesome Sir !! Many Thanks !!

[@eclecticedge007]

It is crystal clear. Thank you so much! keep doing such videos.

[@WiliamSilvaBR]

This class was great! Thank you master!

[@_TechWind]

if i want to know any concept i always prefer your channel 👍. the way you explain is good, it helps too

[@Javatechie]

Thank you buddy 🤗

[@samirvithlani6770]

too simple explanation great sir thank you so much

[@manoharkota937]

Great session, really I got clarified all the queries in this video, thank you so much!

[@gourishankarmohanty2097]

Thanks Basant .. For OAuth2 Example.

[@-indeed8285]

Amazing.. You explanation is to the point.. Like that.. 👍 I hope you upload new video regularly. 💙

[@Javatechie]

Thank you Mohammad + Yes will continue upload on every weekend 👍

[@user-vq6yi7se2r]

Great great clear explanation! Thank you Boss

[@ranjandas7891]

Nice explanation Sir..keep it up(This is Ranjan Das from Facebook😛)

[@srinivasbala8073]

Thank You, Your explanation is nice, I understood and did a simple OAuth application

[@RiteshSingh-th9nf]

your content is awesome as always..

[@sreddy8141]

Thanks Sir🙂 Helped me to understand. How authorization server generates token and resource server validates the same, could you please explain sir

[@srinig7581]

Very nice bro. Splendid job

[@raghuvaranaj1863]

Nice explanation. Please do signout section as well.

[@opendeskca6333]

Nice explanation. Awesome!

[@siyedyoussef3202]

Great video Sir 👍👍👍

[@Mohamed-uf5jh]

Good explanation , thanks

[@user-lw2jn8gp3e]

awesome demonstration sir, , kindly do the same okta with the Spring Boot 3 version , the older version not working properly, all the time got bad requests

[@foodgallery5819]

Thank you!

[@chandramanigupta6997]

Splendid job bro.

[@srinich702]

Can you please do one session on two or more microservices with oauth2

[@Javatechie]

Yes I will do that.since maximum viewers requested for the same It's in queue

[@gowtham4383]

Hi bro , This video is really good about Oauth. Having some doubt on this, In the example we registered the local host app to Git hub as an oauth App and client id and client secret key generated. But in real time example Hacker rank with Git Hub login , Hacker rank registered as oauth app automatically post successful github login . How does it happen internally ? Can you explain the code for that ?

[@user-cd2qg9xe6i]

Hi @java Techie if possible can u please upload the video for how the Token is generated and what we need to use for encryption and decryption logic in which class need to write and give access.

[@vasu1297]

Nice bro

[@priyagade8788]

Thank you😊

[@noortech254]

Amazing bhai saab😍😍

[@pentamnaidu]

We can also do single sign on / security by passing using spring security right (http basic authentication) from one application to another by skipping actual login page /screen .

[@bibek4024]

Nice video. Can you make a video using LinkedIn?

[@Javatechie]

Okay I will try this

[@rajarajagopal7522]

Very Good Explanation Basant.. so I guess most of company web applications are using OAuth token security only. Correct?

[@Javatechie]

Yes now a days max using it

[@sandhyaaa24]

Make video on jwt also ;)

[@Javatechie]

Hi sandhya , its already there in my channel here is the link kzbin.info/www/bejne/qHOxgJZqrtKXZ6c

[@smartatwork2344]

Hy, 'Java Techie' linke Tour explanations. Very clear and understandable. One question: What"s the Authentication-Code? Is this a random Nummer choosen by yourself? Thx, bye.

[@Javatechie]

Sorry, not getting you

[@smartatwork2344]

@@Javatechie Sorry, wrong typing. I like your Explanation. When you typed in your Authentication, you also typed in a Number in the field Authentication-Code. Where you where getting this number?

[@Javatechie]

@@smartatwork2344 I enable two factor authentication so I got OTP to email so am using that number

[@br4676]

thanks sir

[@rabindrapatra7151]

simple awesome

[@ArunKumarBushigampala]

Hi.. As per the flow diagram after successful authentication only authorization server sends access token right? then how come access token send as cookie in login page before authentication ?

[@1msubscribers214]

It means each user will add the Clinet application details in their githup profile.... Dynamically how to do sir.. Thanks for ur effort...

[@SmartGaming.1996]

Sir please make a video how to create own identity provider

[@Javatechie]

Yes we can do that . I will try this

[@SmartGaming.1996]

Ok sir please create video as soon as possible because I want to implement it in a practical way

[@SmartGaming.1996]

@@Javatechie Sir please make a video how to create own identity provider

[@DK-js8cz]

@EnableOAuth2Sso this got deprecated and the dependencies you have added in this video not available currently, I think to add OAuth2 in application process is changed. Could you please make a new video on this concept with updated version?

[@joicejoy1331]

What is the authorization grant type used, authorization_code or implicit grant?

[@Javatechie]

Implicit grant

[@ajaydhiman2368]

another question : why you added client security dependency ? spring security dependecncy will not work ? or we really need any of these dependency to create this application ?

[@Javatechie]

You need oauth2 client dependency to delegate your security concern to a 3rd party identity provider (GitHub/ Facebook / Gmail etc...)

[@gopishettymahindra2713]

Hi sir, Can you please explain one post request through postman how you will pass authentication information in the header.

[@Javatechie]

Please check my jwt security video

[@hemanthgarlapati2640]

What is the need of sending back the access token to github resource server which was given by github itself

[@Javatechie]

GitHub authorization server will send access token , how resource server will verify already you authorized it ? That's the reason access token should be 2 way

[@joicejoy1331]

How come the access token in the cookie before sign in to the GitHub account...while you were inspecting the elements

[@Javatechie]

Sorry didn't get you

[@parthanathguitar]

Hello. Very nice example. I have a question. I can see that the client I'd and secret string is directly configured in the spring boot app and that only helps an individual user to be authenticated by Github authorization server. What happens in a real time production grade project? Do we decouple this sensitive information and store it somewhere else. And what configuration we need to make if we want to access the restful api created in this example to be accessed by any user having valid github credential. I hope there is a way to dynamically use the users client I'd and secret key in the spring boot configuration

[@Javatechie]

Hi Prartha, I never tried , let you know soon

[@parthanathguitar]

Sure.. I will search for the same as well

[@SriniVasan-wk5gc]

Hi Sir , needed the updated procedure of Spring security with OAuth2,ssince cloud security ,cloud Outh dependencies are not shown under dependencies of spring initializer,sir

[@sasi2182]

I have one doubt, In this example we put our clent id and secrt id in our appliaction, which was taken from our git hub, 1)But real time like haker rank we cant put mannually right,?? 2) as per my assumption after validating username and password, doest github gave cleint id and scrt id return back to appliacation after succussfull login?? I have these doubt from so many days?? If in that case what we need to put in our yml file??

[@hemalatamohanta2081]

I tried this one ,successfully run application ,and getting login page but login by giving credentials getting error page "site can not be reached ".in application logs are also fine so not able to check exactly why i am getting error.Could you please guiding me on this.

[@Javatechie]

Are you getting GitHub login page right ? If yes then please provide your GitHub credential to login

[@manikantanuj]

Your way of teaching is awesome. I need a help, Actually I want to consume the services of Adobe analytics. I have retrieved all the essential data required but I am confused what to put in "security.oauth2.resource.user-info-uri" property. When I start my server then I am able to login but it stuck on that page only. Can you please help!

[@Javatechie]

What third part you are using for SSO ? Is it same GitHub ?

[@manikantanuj]

@@Javatechie I am trying to fetch the data of Adobe Analytics using API and trying to get it authorized by Oauth2.0. So in Application.properties what should be written under security.oauth2.resource.user-info-uri.

[@AnjaliMishra-gt9wk]

i am getting this error : error: redirect_uri_mismatch error_description: The redirect_uri MUST match the registered callback URL for this application. Please help, even though done same :/

[@Javatechie]

Please validate your callback uri

[@sarojsahoo8763]

Is it recommended to use in a real time Application I mean there is no secrecy of client id and client secret

[@RAJU9622]

No not recommended

[@visva2005]

@video 13.32 you mentioned that Access Token is sent from client . Could you please explain how the client generated access token ? Because we had configured only the Client Secret in the yml file.

[@sais7065]

Same doubt bro

[@Javatechie]

When I say client it is our application buddy.

[@sumeetyadav7141]

I am getting a error --- field error in object 'resourceServerProperties' on field 'tokenInfoUri': rejected value [null]; missing.tokenInfoUri.resourceServerProperties.tokenInfoUri Please help me out

[@Javatechie]

Please google it .

[@sumeetyadav7141]

@@Javatechie not got any solution

[@VikashGupta-wu2fc]

Could you guide how to cret a spring boot oauth 2 with keycloak for multitenant?

[@learncoding2752]

I am trying spring version 2.6.1 and even maven update.. i am unable to get resolved, kindly guide should i change to as you mentioned and or go with that. ?

[@Javatechie]

What is the error ?

[@user-no6lb6rc5y]

i think access token should not deliver by browser which should pass in the backend

[@birruvijaykumar23]

Can u please do vedio on Jaeger tracing

[@Javatechie]

Hi Birru, I never tried this , let me check this

[@birruvijaykumar23]

@@Javatechie tq

[@pankajgupta3002]

Great session , but i want same session with Spring MVC , is it possible ?

[@Javatechie]

Yes possible but need to add more configuration

[@pankajgupta3002]

@@Javatechie could u please make video for this

[@Javatechie]

Need to check,just google it once

[@rishikesharora8681]

HI Basant, I really appreciate your effort, i learnt a lot regarding OAuth2, and mostly asked question in the interview. I tried your example, but it is giving me below exception, tried finding out from StackOverFlow, but no luck, Will you please give any hint or help? java.lang.IllegalStateException: Access token provider returned a null access token, which is illegal according to the contract.

[@Javatechie]

Did you add your own access token as I shown in video how to generate

[@rishikesharora8681]

@@Javatechie Thanks a lot for your quick response, it has been fixed after watching your comment...Thank a lot again 😍

[@gauravvishwakarma7772]

after giving GitHub login credentials, i got page mentioned - you are redirect to authorised application, if your browser does support, click here, after click it is downloaded not further process failed

[@Javatechie]

Can you please share error stack trace

[@gauravvishwakarma7772]

@@Javatechie thank u for reply You are being redirected to the authorized application. If your browser does not redirect you back, please click here to continue. after clicking on 'click here' is get downloaded

[@rexsam3134]

Hi Basant. Spring Boot just got updated to 2.3.4 Inspite of logging out of Github, why is it not asking for the credentials for the next subsequent login when I type the same url on another chrome tab? I dont want to restart the app

[@Javatechie]

Wao great update let me check if there is any update

[@rexsam3134]

@@Javatechie Yes I found the Tomcat jars are new as compared to the 2.3.3 version

[@shriomtechnology1779]

where you get this below url's.- accessTokenUri, userAuthorizationUri, userInfoUri. if i want to the same OAuth authentication for FB or any other authorization portal. where i can get this url's.

[@Javatechie]

While registering application into GitHub you will get those information

[@shriomtechnology1779]

Thank you very much 😊. Very quick response. Nice explanation 👍

[@RanjeetKumar-ld7cl]

HI Basant I am getting below error after login ava.lang.IllegalStateException: Access token provider returned a null access token, which is illegal according to the contract.

[@sarojsahoo8763]

One more question Is OAuth2 is also responsible for authentication !

[@Javatechie]

Yes

[@hemanthgarlapati2640]

Where we can see the user information after token got validated

[@Javatechie]

You can't see user information GitHub resource server will send to client based on your permission .

[@rexsam3134]

Pls Zoom in your screen. Please explain the yml configuration parameters added Boot 2.4.1 doest have Spring Cloud Security enabled

[@rexsam3134]

2.1.4 is no longer supported in STS 4 and gives ClassNotFoundException 2.3.7 gives "message": "Not Found", "documentation_url": "docs.github.com/rest"

[@vengateshm2122]

How to do logout? Please explain.

[@farrukhkhan967]

How do we know if we are using 2 legged or 3 legged ?

[@deepaatekar8827]

Able to login but unable to logout

[@sarojsahoo8763]

How the access token is getting generated by Authorization server and How Resource server is validating whether it is a correct access_token or not!

[@Javatechie]

Saroj I inspected the console if you notice while sending request it will send token as part of request header if it is not valid you will get 403 status code else 200 You can also do same just inspect your browser while sending first request

[@RAJU9622]

Saroj actually , before launching the page there will be one more call to git hub to give the access token, that access token given by github because application is sending in the request client if and secret , as it’s matching with the git oauth2 credentials so only git hub authenticated and given the access token. If you want to test give wrong secret I will never get back the access token and u r not able to login I will get 403 error as Basant said. Let me know if need more information or anything confusion.

[@Dreamriter]

its Oauth 1 concept not Oauth 2

[@sarojsahoo8763]

please remove ur clent id and secret from github repo

[@bijaystha6308]

Hello, will the information (emails) be stored in local database?

[@Javatechie]

Yes you can store but what is the usecase