OAuth2 is used for authorization, OpenID Connect (OIDC) provides identity authentication based on OAuth2 to confirm user identity. 2. Using Spring Boot and Spring Security is the recommended way to implement OIDC in Java, and spring-boot-starter-oauth2-client dependency needs to be introduced. 3. Configure client-id, client-secret, scope (including openid, profile, email) and issuer-uri of IdP (such as Google) in application.yml to enable automatic metadata discovery. 4. Configure SecurityConfig through @EnableWebSecurity, enable oauth2Login and set the default success page. 5. Use @AuthenticationPrincipal to obtain the OAuth2User object and extract user information such as name, email, picture, etc. from its properties. 6. When supporting multiple providers (such as Google and GitHub), register multiple clients in the configuration and provide corresponding login links. 7. Spring automatically verifies the signature, issuer, audience and validity period of the ID token. The production environment must use HTTPS, and sensitive tokens must be stored encrypted. 8. User information mapping and persistence can be handled through custom OAuth2UserService. Summary: Using Spring Boot configuration drivers allows fast and secure integration of OIDC without writing underlying protocol logic, and managed user authentication by trusted identity providers.

Implementing OAuth2 and OpenID Connect (OIDC) in a Java application allows you to securely handle user authentication and authorization, especially when integrating with identity providers like Google, GitHub, or enterprise solutions like Okta and Auth0. Here's a practical guide to get it working effectively.

1. Understand the Difference Between OAuth2 and OpenID Connect

Before diving into code:

• OAuth2 is for authorization — it lets your app request access to resources on behalf of a user.
• OpenID Connect (OIDC) is built on top of OAuth2 and adds authentication — it verifies who the user is and returns identity information (like email, name).

In short: Use OIDC when you need to log users in and know who they are.

2. Choose the Right Java Framework

The easiest way to implement OIDC in Java is using Spring Security with Spring Boot . It has built-in support for OAuth2 Login and OIDC.

Dependencies (Maven)

 <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

Note: You don't need starter-oauth2-resource-server unless your app is also accepting access tokens from other services.

3. Configure Application Properties

Set up your identity provider (IdP) in application.yml or application.properties .

Example: Using Google as OIDC Provider

 spring:
  security:
    oauth2:
      client:
        Registration:
          google:
            client-id: your-client-id
            client-secret: your-client-secret
            scope: openid, profile, email
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        Provider:
          google:
            issuer-uri: https://accounts.google.com

• client-id and client-secret : Get these from the IdP (eg, Google Cloud Console).
• scope : openid enables OIDC; profile and email fetch user info.
• issuer-uri : Spring uses this to auto-discover OIDC metadata (JWKS, authorization endpoint, etc.).

Tip: You can use any provider that supports OIDC (Auth0, Azure AD, Okta, etc.) — just adjust the issuer URI and client credentials.

4. Enable OAuth2 Login in Spring Security

Create a security configuration class:

 @Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/", "/login**", "/error**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .defaultSuccessUrl("/home")
            );
        return http.build();
    }
}

Now, when a user accesses a secured page, they'll be redirected to Google (or your IdP) to log in.

5. Access User Information After Login

Once authenticated, you can retrieve user details from the OAuth2User .

Example Controller

 @GetMapping("/home")
public String home(Model model, @AuthenticationPrincipal OAuth2User principal) {
    if (principal != null) {
        model.addAttribute("name", principal.getAttribute("name"));
        model.addAttribute("email", principal.getAttribute("email"));
        model.addAttribute("picture", principal.getAttribute("picture"));
    }
    return "home";
}

The attributes ( name , email , etc.) come from the ID token and/or the UserInfo endpoint, depending on the provider.

6. Handling Multiple Providers

You can support multiple OIDC providers (eg, Google, GitHub, Microsoft):

 spring:
  security:
    oauth2:
      client:
        Registration:
          google:
            client-id: ...
            client-secret: ...
            scope: openid, profile, email
          github:
            client-id: ...
            client-secret: ...
            scope: user:email
            authorization-grant-type: authorization_code
            client-authentication-method: client_secret_post

Then, on your login page:

 <a href="/oauth2/authorization/google">Sign in with Google</a>
<a href="/oauth2/authorization/github">Sign in with GitHub</a>

Spring automatically sets up these endpoints.

7. Token Validation and Security Considerations

• ID Token Validation : Spring Security automatically validates the JWT ID token (signature, issuer, audience, expiration) when using issuer-uri .
• Use HTTPS in production — OIDC relies on secure communication.
• Avoid storing tokens in plain text — if you need to save refresh tokens, encrypt them.

8. Customizing User Processing (Optional)

If you need to map OIDC claims to your app's user model, define a OAuth2UserService :

 @Bean
public OAuth2UserService<OAuth2UserRequest, OAuth2User> customOAuth2UserService() {
    return userRequest -> {
        OAuth2UserService<OAuth2UserRequest, OAuth2User> delegate = new DefaultOAuth2UserService();
        OAuth2User oAuth2User = delegate.loadUser(userRequest);

        // Add custom logic: map roles, save user to DB, etc.
        return new CustomOAuth2User(oAuth2User);
    };
}

Then wire it into the login flow:

 .oauth2Login(oauth2 -> oauth2
    .userInfoEndpoint(userInfo -> userInfo
        .userService(customOAuth2UserService())
    )
)

Summary

Implementing OAuth2 and OpenID Connect in Java (especially with Spring Boot) is straightforward:

• Use Spring Security's spring-boot-starter-oauth2-client
• Configure your IdP via application.yml
• Enable OAuth2 login in security config
• Retrieve user info via @AuthenticationPrincipal
• Optionally customize user processing or support multiple providers

It's secure, scalable, and keeps you from managing passwords — let trusted identity providers do the heavy lifting.

Basically, once you've set up the redirect URIs and got the client credentials, the rest is configuration-driven and doesn't require writing low-level OIDC logic yourself.

The above is the detailed content of Implementing OAuth2 and OpenID Connect in a Java Application. For more information, please follow other related articles on the PHP Chinese website!