Using OAuth2 in Spring Boot App with {okta}




  • Add the following dependencies in POM file


<dependency>
    <groupId>com.okta.spring</groupId>
    <artifactId>okta-spring-boot-starter</artifactId>
    <version>0.2.0</version>
</dependency>


        <dependency>
            <groupId>org.springframework.security.oauth</groupId>
            <artifactId>spring-security-oauth2</artifactId>
            <version>2.2.0.RELEASE</version>
        </dependency>


  • In spring boot main class add the following Bold and Underlined code


           import org.springframework.boot.autoconfigure.SpringBootApplication;
           import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;


         @EnableResourceServer
         @SpringBootApplication
        public class DemoApplication {

           public static void main(String[] args) {
                   SpringApplication.run(DemoApplication.class, args);
          }
       }

  • Log in to your Okta developer account (or sign up if you don't have an account) and navigate to Applications > Add Applications. Click Single-Page App, click Next and give the app name. Change all instances of localhost:8080 to localhost:3000 (or localhost:4200 if you have angular client) and click Done.
  • Copy the client Id into your server/src/main/resources/application.properties file as:
              okta.oauth2.issuer=https://dev-396769.oktapreview.com/oauth2/default
                  okta.oauth2.clientId=0axfedeaf8D2NZakn0h7
                    security.oauth2.resource.tokenInfoUri=https://dev-396769.oktapreview.com/oauth2/default

      Make sure you don't include -admin in these urls.

      After setting, run your spring boot app and access and you will get the following page.




      Comments

      Post a Comment

      Popular posts from this blog

      JavaScript - ES2015 (aka ES6)

      The ES2015 Since this long time passed between ES5.1 and ES6, the release is full of important new features and major changes in suggested best practices in developing JavaScript programs. To understand how fundamental ES2015 is, just keep in mind that with this version, the specification document went from 250 pages to ~600. In this blog, we describe the most important changes. Arrow Functions A new  this   scope Promises Generators let   and  const Classes Constructor Super Getters and setters Modules Importing modules Exporting modules Template Literals Default parameters The spread operator Destructuring assignments Enhanced Object Literals Simpler syntax to include variables Prototype super() Dynamic properties For-of loop Map and Set New String methods New Object methods Arrow functions Arrow functions since their introduction changed how most JavaScript code looks (and works). Visually, it’s a simple and welcome ...
      Read more

      Data Bound Controls in ASP.Net - Part 4 (FormView and DetailsView controls)

      FormView The FormView control is used to display a single record from a data source. It is similar to the DetailsView control, except it displays user-defined templates instead of row fields. Creating your own templates gives you greater flexibility in controlling how the data is displayed. The FormView control supports the following features: ·          Binding to data source controls, such as SqlDataSource and ObjectDataSource. ·          Built-in inserting, updating and deleting capabilities. ·          Built-in paging capabilities. ·          Programmatic access to the FormView object model to dynamically set properties, handle events, and so on. ·          Customizable appearance through user-defined templates, themes, and styles. Templates For the FormView control ...
      Read more

      The Clickjacking attack and X-Frame-Options

      Clickjacking  Clickjacking is a type of “web framing” or “UI redressing” attack. What that simply means in practice is that: 1. A user (victim) is shown an innocuous, but enticing web page (think watch online video) 2. Another web page (that generally does something important – think add friends on social network) is layered on top of the first page and set to be transparent 3. When the user thinks they are clicking on the web page they see (video), they are actually clicking on the higher layered (framed) page that is transparent There are two main ways to prevent clickjacking: 1.     Sending the proper X-Frame-Options HTTP response headers that instruct the browser to not allow framing from other domains 2.     Employing defensive code in the UI to ensure that the current frame is the most top level window Using X-Frame-Options X-Frame-Options  originally invented by Microsoft for IE8, but supported by a number ...
      Read more