This page focuses on Spring Security's OpenID Connect protocol support. Looking for Spring Security’s (C)IAM features like MFA, SSO, and user management? View Spring Security on the (C)IAM Identity Providers benchmark.

Spring Security OpenID Connect Provider

🇺🇸

Open-source authentication and authorization framework for Java applications built on Spring. Embedded directly in your application and backed by your own user store, with form login, passkeys, one-time token (magic link) login, multi-factor authentication through factor authorities, OAuth 2.0 / OpenID Connect login and resource server, and SAML 2.0 service provider support. Spring Authorization Server adds an OAuth 2.1 and OpenID Connect 1.0 provider. Core differentiator: it is a library, not a hosted service, so there is no vendor server or per-user pricing. It ships no user management, admin console or hosted UI, and everything from user storage to MFA enrollment is assembled by the application. Commercial support is available through Tanzu Spring.

Features

Grant Types

Extensions

Endpoints

Token Endpoint Authentication Methods

none
client_secret_basic
client_secret_post
client_secret_jwt
private_key_jwt
tls_client_auth

Prompts

Features

Financial-grade API (FAPI)

If you want to compare OpenID Connect features of different providers, please check out the OpenID Connect Providers benchmark.

Looking for Spring Security’s (C)IAM features like MFA, SSO, and user management? View Spring Security on the (C)IAM Identity Providers benchmark.

Frequently Asked Questions

Does Spring Security support the Authorization Code grant type?

Spring Security supports Authorization Code grant type. Authorization code flow in the authorization server, with optional user consent. Also supported by the OAuth 2.0 client and OIDC login. Read more

Does Spring Security support the Refresh Token grant type?

Spring Security supports Refresh Token grant type. Refresh token grant on the token endpoint and in the OAuth 2.0 client. Read more

Does Spring Security support the Client Credentials grant type?

Spring Security supports Client Credentials grant type. Client credentials grant on the token endpoint and in the OAuth 2.0 client. Read more

Does Spring Security support the Implicit grant type?

Spring Security does not support Implicit grant type. Not offered, consistent with OAuth 2.1. Read more

Does Spring Security support the Token Exchange grant type?

Spring Security supports Token Exchange grant type. OAuth 2.0 Token Exchange (RFC 8693) on the token endpoint. The OAuth 2.0 client can also request token exchange. Read more

Does Spring Security support the Client Initiated BackChannel Authentication grant type?

Spring Security does not support Client Initiated BackChannel Authentication grant type. Not listed among the supported grants. Read more

Does Spring Security support the Device Authorization Grant grant type?

Spring Security supports Device Authorization Grant grant type. OAuth 2.0 Device Authorization Grant (RFC 8628) with a device verification endpoint and consent. Read more

Does Spring Security support the JWT Bearer Token grant type?

Spring Security does not support JWT Bearer Token grant type. The authorization server does not accept this grant. The OAuth 2.0 client can send it as an opt-in extension. Read more

Does Spring Security support the SAML 2.0 Bearer Assertion grant type?

Spring Security does not support SAML 2.0 Bearer Assertion grant type. Not supported.

Does Spring Security support the Resource Owner Password Credentials grant type?

Spring Security does not support Resource Owner Password Credentials grant type. Not offered, consistent with OAuth 2.1. Read more

Does Spring Security support the PKCE extension?

Spring Security supports PKCE extension. PKCE (RFC 7636) on the authorization server, with proof key requirements per client. Automatic PKCE for public clients in the OAuth 2.0 client. Read more

Does Spring Security support the PAR extension?

Spring Security supports PAR extension. Pushed Authorization Requests (RFC 9126) endpoint on the authorization server. Read more

Does Spring Security support the RAR extension?

Spring Security does not support RAR extension. Not documented. Read more

Does Spring Security support the JAR extension?

Spring Security does not support JAR extension. Not documented. Read more

Does Spring Security support the Authorization Endpoint endpoint?

Spring Security supports Authorization Endpoint endpoint. Authorization endpoint with consent handling and customisable consent page. Read more

Does Spring Security support the Token Endpoint endpoint?

Spring Security supports Token Endpoint endpoint. Token endpoint for authorization code, refresh token, client credentials, device code and token exchange grants. Read more

Does Spring Security support the UserInfo Endpoint endpoint?

Spring Security supports UserInfo Endpoint endpoint. OIDC UserInfo endpoint, with claims mapped from the ID token by requested scopes and customisable through userInfoMapper. Read more

Does Spring Security support the Token Revocation endpoint?

Spring Security supports Token Revocation endpoint. Token revocation endpoint (RFC 7009). Read more

Does Spring Security support the Token Introspection endpoint?

Spring Security supports Token Introspection endpoint. Token introspection endpoint (RFC 7662). Read more

Does Spring Security support the Device Authorization Endpoint endpoint?

Spring Security supports Device Authorization Endpoint endpoint. Device authorization endpoint (RFC 8628). Read more

Does Spring Security support the OpenID Connect Discovery Endpoint endpoint?

Spring Security supports OpenID Connect Discovery Endpoint endpoint. OpenID Connect provider configuration endpoint, customisable through a metadata customizer. Read more

Does Spring Security support the OAuth 2.0 Authorization Server Metadata Endpoint endpoint?

Spring Security supports OAuth 2.0 Authorization Server Metadata Endpoint endpoint. Authorization server metadata endpoint (RFC 8414). Read more

Does Spring Security support the none token endpoint authentication method?

Spring Security supports none token endpoint authentication method. Public clients, typically with PKCE. Read more

Does Spring Security support the client_secret_basic token endpoint authentication method?

Spring Security supports client_secret_basic token endpoint authentication method. Client secret in the HTTP Basic header. Read more

Does Spring Security support the client_secret_post token endpoint authentication method?

Spring Security supports client_secret_post token endpoint authentication method. Client secret in the request body. Read more

Does Spring Security support the client_secret_jwt token endpoint authentication method?

Spring Security supports client_secret_jwt token endpoint authentication method. JWT client assertion signed with the client secret (RFC 7523). Read more

Does Spring Security support the private_key_jwt token endpoint authentication method?

Spring Security supports private_key_jwt token endpoint authentication method. JWT client assertion signed with the client's private key (RFC 7523). Read more

Does Spring Security support the tls_client_auth token endpoint authentication method?

Spring Security supports tls_client_auth token endpoint authentication method. Mutual-TLS client authentication (RFC 8705), with both CA-issued (tls_client_auth) and self-signed certificate (self_signed_tls_client_auth) methods. Read more

Does Spring Security support the RP-initiated Logout feature?

Spring Security supports RP-initiated Logout feature. OpenID Connect RP-Initiated Logout endpoint on the authorization server, validating post_logout_redirect_uri. The relying party side offers RP-initiated and back-channel logout. Read more

Does Spring Security support the Dynamic Client Registration Protocol feature?

Spring Security supports Dynamic Client Registration Protocol feature. OIDC Dynamic Client Registration endpoint, disabled by default and protected by a bearer token carrying the client.create scope. Read more

Does Spring Security support the Dynamic Client Registration Management Protocol feature?

Spring Security partially supports Dynamic Client Registration Management Protocol feature. A client configuration endpoint supports reading a registered client (client.read scope). Updating and deleting through the registration management protocol is not documented. Read more

Does Spring Security support the Refresh Token Rotation feature?

Spring Security supports Refresh Token Rotation feature. A new refresh token is issued on each use when reuseRefreshTokens is disabled in TokenSettings. Refresh tokens are reused by default. Read more

Does Spring Security support the Refresh Token Rotation Grace Period feature?

Spring Security does not support Refresh Token Rotation Grace Period feature. Not documented. Read more

Does Spring Security support the OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature?

Spring Security supports OAuth 2.0 Demonstrating Proof of Possession (DPoP) feature. DPoP-bound access tokens (RFC 9449) are issued by the authorization server for all grant types, with cnf.jkt in JWT access tokens. The resource server validates DPoP proofs for JWT and opaque tokens. Read more

Does Spring Security support the FAPI 1.0 Security Profile - Part 1: Baseline feature?

Spring Security does not support FAPI 1.0 Security Profile - Part 1: Baseline feature. No conformance claim.

Does Spring Security support the FAPI 1.0 Security Profile - Part 2: Advanced feature?

Spring Security does not support FAPI 1.0 Security Profile - Part 2: Advanced feature. No conformance claim.

Does Spring Security support the FAPI 2.0 Message Signing feature?

Spring Security does not support FAPI 2.0 Message Signing feature. No conformance claim.

Does Spring Security support the JARM feature?

Spring Security does not support JARM feature. Not documented.

Compare with other providers

Note: The current data is based on provider documentation/experience and may not be 100% accurate.