Spring Security IAM Provider
Open-source authentication and authorization framework for Java applications built on Spring. Embedded directly in your application and backed by your own user store, with form login, passkeys, one-time token (magic link) login, multi-factor authentication through factor authorities, OAuth 2.0 / OpenID Connect login and resource server, and SAML 2.0 service provider support. Spring Authorization Server adds an OAuth 2.1 and OpenID Connect 1.0 provider. Core differentiator: it is a library, not a hosted service, so there is no vendor server or per-user pricing. It ships no user management, admin console or hosted UI, and everything from user storage to MFA enrollment is assembled by the application. Commercial support is available through Tanzu Spring.
Features
- 🇸🇪🇱🇫🇒ðŸ‡ðŸ‡´ðŸ‡¸ðŸ‡¹ðŸ‡ªðŸ‡©Self-hosted
- On-premisesAny cloud
- JavaKotlinSpring BootSpring MVCSpring WebFlux
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for Spring Security’s OpenID Connect protocol compatibility? View Spring Security on the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does Spring Security support Username and Password authentication method?
Spring Security supports Username and Password authentication method. Form login, HTTP Basic and Digest, backed by UserDetailsService and a PasswordEncoder (DelegatingPasswordEncoder with bcrypt by default; argon2, scrypt and PBKDF2 also available). In-memory, JDBC and LDAP user stores are built in. Read more
Does Spring Security support Social Sign-in authentication method?
Spring Security supports Social Sign-in authentication method. OAuth 2.0 Login with OpenID Connect or plain OAuth 2.0 providers through ClientRegistration entries. Common providers such as Google, GitHub, Facebook and Okta ship as presets and any other provider can be configured with its endpoints or issuer URI. Read more
Does Spring Security support Passkey authentication method?
Spring Security supports Passkey authentication method. Passkeys (WebAuthn) through the spring-security-webauthn module and the webAuthn() DSL. Requires rpId and allowedOrigins, a registration step while authenticated, and in-memory or JDBC credential repositories. Read more
Does Spring Security support Email Passwordless authentication method?
Spring Security partially supports Email Passwordless authentication method. One-time token login (oneTimeTokenLogin()) issues a short-lived token for a username and the application delivers it by email through a OneTimeTokenGenerationSuccessHandler. It is a token or link flow, not a numeric OTP code, and no email delivery is built in. Read more
Does Spring Security support Phone Passwordless authentication method?
Spring Security partially supports Phone Passwordless authentication method. The same one-time token login can be delivered by SMS, but delivery is entirely application-supplied and there is no phone-number identity or verification built in. Read more
Does Spring Security support Magic Link authentication method?
Spring Security supports Magic Link authentication method. One-time token login with a configurable generate endpoint (POST /ott/generate) and submit page (/login/ott) that pre-fills the token from a link. Default expiry is 5 minutes. The default token service is in-memory, with JdbcOneTimeTokenService for production. Read more
Does Spring Security support Anonymous / Guest authentication method?
Spring Security partially supports Anonymous / Guest authentication method. The anonymous authentication filter gives unauthenticated requests an anonymous Authentication so authorization rules can target them. There are no persistent guest accounts or guest-to-registered upgrade flow. Read more
Does Spring Security support Time-based One-Time Password (TOTP) MFA?
Spring Security does not support Time-based One-Time Password (TOTP) MFA. No built-in TOTP or authenticator-app support. It has to be implemented as a custom authentication mechanism that grants a FactorGrantedAuthority. Read more
Does Spring Security support HMAC-based One-Time Password (HOTP) MFA?
Spring Security does not support HMAC-based One-Time Password (HOTP) MFA. No built-in HOTP support. Read more
Does Spring Security support Universal 2nd Factor (U2F) MFA?
Spring Security does not support Universal 2nd Factor (U2F) MFA. No legacy U2F support. Hardware security keys are handled through WebAuthn. Read more
Does Spring Security support WebAuthn MFA?
Spring Security supports WebAuthn MFA. WebAuthn / passkeys can be required as a factor through FactorGrantedAuthority.WEBAUTHN_AUTHORITY, alone or combined with password or one-time token factors. Documented in the 7.x multi-factor authentication guide. Read more
Does Spring Security support Email Code MFA?
Spring Security partially supports Email Code MFA. The one-time token factor (OTT_AUTHORITY) can be required as a second factor and delivered by email, but the application supplies delivery and the token is a link or token value rather than a short code. Read more
Does Spring Security support Phone Code MFA?
Spring Security partially supports Phone Code MFA. The one-time token factor can be delivered by SMS as a second factor, but delivery is application-supplied and nothing phone-specific is built in. Read more
Does Spring Security support Recovery Code MFA?
Spring Security does not support Recovery Code MFA. No recovery code mechanism. Read more
Does Spring Security support Push Notification MFA?
Spring Security does not support Push Notification MFA. No push notification factor. Read more
Does Spring Security support Adaptive / Risk-Based MFA MFA?
Spring Security partially supports Adaptive / Risk-Based MFA MFA. MFA can be applied conditionally: per request, per authority, per user through a RequiredAuthoritiesRepository, or only for users with a registered passkey. There is no built-in risk engine or signal-based scoring. Read more
Does Spring Security support Cisco Duo MFA?
Spring Security does not support Cisco Duo MFA. No Cisco Duo integration is provided by Spring Security.
Does Spring Security support Step-Up Authentication MFA?
Spring Security supports Step-Up Authentication MFA. Requiring a specific factor authority on selected paths redirects users to obtain the missing factor. Factors can be time-bound with validDuration so users must re-authenticate after a set period. Read more
Does Spring Security support OpenID Connect (OIDC) integration protocol?
Spring Security supports OpenID Connect (OIDC) integration protocol. Covers all three roles: OpenID Connect relying party (OAuth 2.0 Login), OAuth 2.0 resource server (JWT and opaque tokens), and OpenID Provider through the OAuth 2.1 / OIDC authorization server (Spring Authorization Server). Read more
Does Spring Security support SAML 2.0 integration protocol?
Spring Security partially supports SAML 2.0 integration protocol. SAML 2.0 service provider (relying party) only: login, single logout and metadata, built on OpenSAML. Spring Security cannot act as a SAML identity provider. Read more
Does Spring Security support WS-Federation integration protocol?
Spring Security does not support WS-Federation integration protocol. WS-Federation is not supported.
Does Spring Security support Machine-to-Machine (M2M) Authentication integration protocol?
Spring Security supports Machine-to-Machine (M2M) Authentication integration protocol. The client credentials grant is supported on the OAuth 2.0 client side and on the authorization server. Resource servers validate the resulting JWT or opaque access tokens. Read more
Does Spring Security support OpenID Connect (OIDC) Federation identity federation?
Spring Security supports OpenID Connect (OIDC) Federation identity federation. Authenticate users against one or more external OpenID Connect providers with oauth2Login(). Multiple ClientRegistrations are offered on a generated provider picker page. Read more
Does Spring Security support SAML 2.0 Federation identity federation?
Spring Security supports SAML 2.0 Federation identity federation. Multiple SAML 2.0 asserting parties can be registered, including from federation metadata with RelyingPartyRegistrations.collectionFromMetadataLocation(...). Metadata can be cached and refreshed. Read more
Does Spring Security support Active Directory / LDAP identity federation?
Spring Security supports Active Directory / LDAP identity federation. LDAP authentication and authorities lookup are built in, with bind, password-compare and Active Directory-specific authentication providers. Read more
Does Spring Security support Azure Active Directory (Entra ID) identity federation?
Spring Security supports Azure Active Directory (Entra ID) identity federation. Microsoft Entra ID is usable as an external identity provider through generic OpenID Connect (issuer URI) or SAML 2.0 relying party configuration. There is no dedicated Entra ID module in Spring Security itself. Read more
Does Spring Security support Bulk User Import user management?
Spring Security does not support Bulk User Import user management. No import tooling. User storage is the application's own (UserDetailsService, JdbcUserDetailsManager or custom repositories). Read more
Does Spring Security support Password Hash Import (Multiple Formats) user management?
Spring Security partially supports Password Hash Import (Multiple Formats) user management. DelegatingPasswordEncoder validates the stored {id}hash format, so existing hashes from several algorithms can be kept and verified alongside new bcrypt hashes. There is no import tool. Read more
Does Spring Security support Bulk User Export user management?
Spring Security does not support Bulk User Export user management. No export tooling.
Does Spring Security support Bulk User Update / Delete user management?
Spring Security does not support Bulk User Update / Delete user management. No bulk operations. UserDetailsManager only offers single-user create, update and delete. Read more
Does Spring Security support Upsert on Import user management?
Spring Security does not support Upsert on Import user management. No import mechanism.
Does Spring Security support Legacy Username Import (Non-Allowed Characters) user management?
Spring Security does not support Legacy Username Import (Non-Allowed Characters) user management. No import mechanism.
Does Spring Security support MFA Enrollment Import user management?
Spring Security does not support MFA Enrollment Import user management. No import mechanism and no built-in MFA enrollment store apart from passkey credential repositories.
Does Spring Security support Inbound SCIM Provisioning user management?
Spring Security does not support Inbound SCIM Provisioning user management. No SCIM server.
Does Spring Security support Outbound SCIM Provisioning user management?
Spring Security does not support Outbound SCIM Provisioning user management. No SCIM client.
Does Spring Security support SCIM Groups Provisioning user management?
Spring Security does not support SCIM Groups Provisioning user management. No SCIM support.
Does Spring Security support Just-In-Time (JIT) User Provisioning user management?
Spring Security partially supports Just-In-Time (JIT) User Provisioning user management. Custom OAuth2UserService, OidcUserService or SAML response authentication converters can create or update a local user on first federated login. This is application code, not a configuration option. Read more
Does Spring Security support Lazy / Trickle Migration from Legacy Database user management?
Spring Security partially supports Lazy / Trickle Migration from Legacy Database user management. A custom UserDetailsService or AuthenticationProvider can authenticate against a legacy store, and DaoAuthenticationProvider can re-encode passwords on login through UserDetailsPasswordService. There is no turnkey migration feature. Read more
Does Spring Security support Self-Service Profile Management Portal user management?
Spring Security does not support Self-Service Profile Management Portal user management. No profile or account management portal. Applications build their own.
Does Spring Security support User Account Linking user management?
Spring Security does not support User Account Linking user management. No built-in account linking. Federated principals are mapped to local users in application code.
Does Spring Security support User Blocking / Banning user management?
Spring Security supports User Blocking / Banning user management. UserDetails flags (enabled, accountNonLocked, accountNonExpired, credentialsNonExpired) are enforced at authentication and produce DisabledException, LockedException and related failure events. There is no admin UI. Read more
Does Spring Security support User Metadata user management?
Spring Security does not support User Metadata user management. There is no built-in user profile or metadata store. Custom attributes are modelled in the application's UserDetails and database. Read more
Does Spring Security support Application Metadata user management?
Spring Security does not support Application Metadata user management. No built-in application metadata store. Read more
Does Spring Security support Metadata Size Limits user management?
Spring Security does not support Metadata Size Limits user management. No built-in metadata store, so no limits are defined.
Does Spring Security support User Search user management?
Spring Security does not support User Search user management. No user search API. Lookup is by username through UserDetailsService. Read more
Does Spring Security support Role-Based Access Control (RBAC) user management?
Spring Security supports Role-Based Access Control (RBAC) user management. Roles and authorities on every Authentication, enforced by request authorization rules (hasRole, hasAuthority) and method security, with role hierarchy support. Read more
Does Spring Security support Organizations (Multi-Tenancy B2B) user management?
Spring Security partially supports Organizations (Multi-Tenancy B2B) user management. Multi-tenant building blocks exist: multiple JWT issuers on a resource server, multiple SAML relying party registrations, and multiple issuers on the authorization server. There is no B2B organization or membership model. Read more
Does Spring Security support Password Strength Policies user management?
Spring Security partially supports Password Strength Policies user management. A CompromisedPasswordChecker (Have I Been Pwned) is built in. There are no composition, length or history rules, which are left to the application. Read more
Does Spring Security support Username Restrictions user management?
Spring Security does not support Username Restrictions user management. No built-in username rules. Validation is up to the application.
Does Spring Security support Progressive Profiling / Forms user management?
Spring Security does not support Progressive Profiling / Forms user management. No profile forms or progressive profiling.
Does Spring Security support Attribute-Based Access Control (ABAC) access control?
Spring Security supports Attribute-Based Access Control (ABAC) access control. Method security (@PreAuthorize, @PostAuthorize) evaluates Spring Expression Language and custom AuthorizationManagers against user, request and domain object attributes. Read more
Does Spring Security support Fine-Grained Authorization (FGA / ReBAC) access control?
Spring Security partially supports Fine-Grained Authorization (FGA / ReBAC) access control. Domain object security (ACLs) assigns permissions on individual objects to principals. It is not a relationship-based (ReBAC / Zanzibar-style) engine. Read more
Does Spring Security support API Authorization (Scopes / Permissions) access control?
Spring Security supports API Authorization (Scopes / Permissions) access control. The resource server maps token scopes to SCOPE_ authorities and enforces them per request or method. Authorities can be customised with a JwtAuthenticationConverter. Read more
Does Spring Security support Audit Log Retention security feature?
Spring Security does not support Audit Log Retention security feature. Authentication and authorization events are published as Spring application events, but nothing is persisted. Storage and retention must be implemented in event listeners. Read more
Does Spring Security support Audit Log Streaming security feature?
Spring Security does not support Audit Log Streaming security feature. No log streaming. Events can be forwarded by custom listeners to any sink. Read more
Does Spring Security support Security Center (Threat Monitoring Dashboard) security feature?
Spring Security does not support Security Center (Threat Monitoring Dashboard) security feature. No security dashboard.
Does Spring Security support Encryption at Rest security feature?
Spring Security partially supports Encryption at Rest security feature. Database encryption is the host application's responsibility. The spring-security-crypto module provides Encryptors (AES-based) and key generators for application-level encryption. Read more
Does Spring Security support Encryption in Transit security feature?
Spring Security supports Encryption in Transit security feature. HTTPS redirect (requiresChannel), HSTS and other security headers, and secure cookie settings are built in. TLS itself is terminated by the container or a proxy. Read more
Does Spring Security support Customer Managed Keys (BYOK) security feature?
Spring Security partially supports Customer Managed Keys (BYOK) security feature. Everything is self-hosted, so keys are customer-controlled. The authorization server and JWT support take signing keys from an application-supplied JWKSource or JwtEncoder, which can be backed by a keystore or external key service. Read more
Does Spring Security support Bot Detection security feature?
Spring Security does not support Bot Detection security feature. No bot detection or CAPTCHA integration.
Does Spring Security support Brute Force Protection security feature?
Spring Security partially supports Brute Force Protection security feature. Locked accounts are enforced and failed attempts raise authentication failure events, but there is no built-in attempt counting, throttling or automatic lockout. Applications implement it on top of events. Read more
Does Spring Security support Suspicious IP Throttling security feature?
Spring Security does not support Suspicious IP Throttling security feature. No IP reputation or throttling.
Does Spring Security support Breached Password Detection security feature?
Spring Security supports Breached Password Detection security feature. HaveIBeenPwnedRestApiPasswordChecker, published as a CompromisedPasswordChecker bean, is applied by DaoAuthenticationProvider and rejects compromised passwords with a CompromisedPasswordException. Read more
Does Spring Security support Credential Guard (Dark Web Monitoring) security feature?
Spring Security does not support Credential Guard (Dark Web Monitoring) security feature. No dark web or credential leak monitoring beyond the Have I Been Pwned password check.
Does Spring Security support Tenant Access Control List (IP ACL) security feature?
Spring Security partially supports Tenant Access Control List (IP ACL) security feature. Requests can be restricted to IP addresses or CIDR ranges with an IpAddressMatcher in authorization rules. This is per application, not a per-tenant IP ACL. Read more
Does Spring Security support Device Fingerprinting security feature?
Spring Security does not support Device Fingerprinting security feature. No device fingerprinting.
Does Spring Security support Per-Organization Branding multi-tenancy?
Spring Security does not support Per-Organization Branding multi-tenancy. No organization model or branding.
Does Spring Security support Per-Organization MFA Policy multi-tenancy?
Spring Security does not support Per-Organization MFA Policy multi-tenancy. No organization model. MFA requirements can be set per user with a RequiredAuthoritiesRepository. Read more
Does Spring Security support Hosted / Universal Login Page branding feature?
Spring Security partially supports Hosted / Universal Login Page branding feature. A basic default login page is generated for form login, one-time token, passkeys and OAuth 2.0 / SAML provider selection. It is served by the application itself and is meant to be replaced, not a separate hosted service. Read more
Does Spring Security support Embedded / Native Login Components branding feature?
Spring Security partially supports Embedded / Native Login Components branding feature. Login runs inside the application with no redirect to a vendor domain, through generated or custom pages. No embeddable login components are provided. Read more
Does Spring Security support White-Label / Full Brand Removal branding feature?
Spring Security supports White-Label / Full Brand Removal branding feature. No vendor branding is shown. Default pages are plain and every page can be replaced. Read more
Does Spring Security support Localization / i18n branding feature?
Spring Security partially supports Localization / i18n branding feature. Authentication and authorization messages are resolved through a MessageSource with bundled translations for many languages. Custom login page text is up to the application. Read more
Does Spring Security support Prebuilt UI Components (SDK) branding feature?
Spring Security does not support Prebuilt UI Components (SDK) branding feature. Only the generated default pages. No UI component library or SDK widgets.
Does Spring Security support Login / Auth Analytics Dashboard analytics?
Spring Security does not support Login / Auth Analytics Dashboard analytics. No analytics dashboard. Authentication events can feed an external analytics tool. Read more
Does Spring Security support GDPR: Data Export (Portability) compliance?
Spring Security does not support GDPR: Data Export (Portability) compliance. No data export feature. Personal data lives in the application's own stores.
Does Spring Security support GDPR: Right to be Forgotten (User Deletion) compliance?
Spring Security partially supports GDPR: Right to be Forgotten (User Deletion) compliance. UserDetailsManager (including JdbcUserDetailsManager) provides deleteUser, but there is no erasure workflow covering sessions, tokens, consents or application data. Read more
Does Spring Security support Consent Management compliance?
Spring Security partially supports Consent Management compliance. The authorization server stores OAuth 2.0 authorization consent per client and user (OAuth2AuthorizationConsentService), with a customisable consent page and device verification consent. No privacy or marketing consent management. Read more
Does Spring Security support Region Deployment compliance?
Spring Security supports Region Deployment compliance. Runs wherever the host application is deployed, so data residency is set by the application and database hosting.
Does Spring Security support Private Cloud Deployment compliance?
Spring Security supports Private Cloud Deployment compliance. Runs inside the application on any cloud or on-premises infrastructure. There is no separate vendor service to deploy.
Does Spring Security support SDK Coverage developer integration?
Spring Security partially supports SDK Coverage developer integration. JVM only. Integrates with Spring MVC (servlet) and Spring WebFlux (reactive) applications, with a Kotlin DSL. Read more
Does Spring Security support Management API developer integration?
Spring Security does not support Management API developer integration. No management API for users or sessions. UserDetailsManager is a programmatic interface only. The authorization server can expose an OIDC client registration endpoint, disabled by default. Read more
Does Spring Security support Authentication API Rate Limits developer integration?
Spring Security does not support Authentication API Rate Limits developer integration. No built-in rate limiting.
Does Spring Security support Actions / Extensibility Pipeline developer integration?
Spring Security supports Actions / Extensibility Pipeline developer integration. Extension is through code: custom filters, AuthenticationProviders, success and failure handlers, event listeners, OAuth2TokenCustomizer, and replaceable services throughout. Read more
Does Spring Security support TypeScript Support in Extensibility developer integration?
Spring Security does not support TypeScript Support in Extensibility developer integration. Extensions are written in Java or Kotlin.
Does Spring Security support Custom Domain developer integration?
Spring Security supports Custom Domain developer integration. The application is served on its own domain, and the authorization server issuer is set through AuthorizationServerSettings. Read more
Does Spring Security support Deploy CLI (Infrastructure as Code) developer integration?
Spring Security does not support Deploy CLI (Infrastructure as Code) developer integration. No CLI. Configuration is part of the application code and properties.
Does Spring Security support Terraform Provider developer integration?
Spring Security does not support Terraform Provider developer integration. No Terraform provider.
Does Spring Security support Custom Database Connections developer integration?
Spring Security supports Custom Database Connections developer integration. Users come from any UserDetailsService, with built-in JDBC support. Authorization server clients, authorizations and consents can use the JDBC implementations or custom repositories. Read more
Does Spring Security support Native Webhook Support developer integration?
Spring Security does not support Native Webhook Support developer integration. No webhooks. Events are in-process Spring application events that listeners can forward. Read more
Does Spring Security support Universal Login / Hosted Login Page Customization developer integration?
Spring Security supports Universal Login / Hosted Login Page Customization developer integration. The login page, one-time token submit page, passkey pages and consent page can each be replaced with application-owned views. Read more
Does Spring Security support Custom Email Provider (SMTP) developer integration?
Spring Security supports Custom Email Provider (SMTP) developer integration. No email sender is included. The application delivers one-time tokens through any provider inside a OneTimeTokenGenerationSuccessHandler. Read more
Does Spring Security support Email Templates developer integration?
Spring Security does not support Email Templates developer integration. No email templates. The application writes the message. Read more
Does Spring Security support Custom OIDC Claims / Token Enrichment developer integration?
Spring Security supports Custom OIDC Claims / Token Enrichment developer integration. OAuth2TokenCustomizer for JWT access tokens, opaque token claims and ID tokens, plus a userInfoMapper for the UserInfo endpoint, on the authorization server. Read more
Does Spring Security support No-Code Auth Flow Builder / Orchestration feature?
Spring Security does not support No-Code Auth Flow Builder / Orchestration feature. No visual or no-code flow builder.
Does Spring Security support Identity Verification / Document Proofing feature?
Spring Security does not support Identity Verification / Document Proofing feature. No identity verification or document proofing.
Does Spring Security support Decentralized / Verifiable Credentials feature?
Spring Security does not support Decentralized / Verifiable Credentials feature. No verifiable credentials or decentralized identifier support.
Does Spring Security support Built-in Billing / Subscription Management feature?
Spring Security does not support Built-in Billing / Subscription Management feature. No billing or subscription management.
Does Spring Security support Agentic AI / MCP Server Authentication feature?
Spring Security partially supports Agentic AI / MCP Server Authentication feature. Generic OAuth 2.x building blocks apply to protecting agent and MCP endpoints: resource server with Protected Resource Metadata, and an authorization server with PKCE, dynamic client registration and DPoP. There is no MCP-specific module in Spring Security. Read more
Does Spring Security support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
Spring Security does not support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. No post-quantum signature algorithms are documented for tokens or SAML.
Does Spring Security support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
Spring Security does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. Not documented.
Does Spring Security support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
Spring Security does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. Not documented.
Does Spring Security support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
Spring Security does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. Not documented.
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.