Відео

This is Codely Blue theme - plugins.jetbrains.com/plugin/12891-codely-theme

Hi Bro, I am getting same error. kindly help us

@RajeshR-u8t @selvalakshmi5074 Can you try to open the client at url 127.0.0.1 instead of localhost. This may be the issue related to cookies.

Let me know if above solution works or not for you guys. Meanwhile, I will also try to reproduce the issue.

Hi @deepakbal841. I am glad you liked the video. You can contact me on Linkedin. The profile link is in channel description.

Can you mention the steps you took to integrate it and what is happening. Also, it would be helpful if you could provide some code to see what you are doing. If not, provide some dummy code.

Can you please provide your emailid, so that I can provide more information

You can message me on LinkedIn. You can find the LinkedIn link in description.

Yes, you can directly interact with azure I'd from client gateway. You don't need to create another Authorization Server. Azure ID will act as Authorization Server in this case. I hope this answers your question.

Thanks 👍

You can connect client directly with Azure Id. You don't need another Authorization Server.

ua-cam.com/video/9PY_Z5h16Js/v-deo.html

You can create your own Logout Confirmation page / modal. And, on clicking on "Confirm Logout" button, just send a POST /logout request.

Thank you for your kind words.

You can do following: Find the port where your authorization server is running. Let's say it is running on port 8081. You you need to find the authorization endpoint. You can do so by visiting URL localhost:8081/.well-known/openid-configuration. You will see Authorize endpoint, use that.

No, CSRF token is required for all POST/PUT... requests, if you have not disabled csrf token on server side. Generally, in api server developers disable csrf, since api servers are accessed by all type of clients (not only browsers).

No, it is not. Try increasing the resolution of the video.

The OAuth 2.0 Client dependency is used in Spring applications to make OAuth client which supports Resource Owner Password Credentials grant type. If you want to use it, the Authorization Server should also support it. But it is highly recommended not to use this grant type. I hope that helps. docs.spring.io/spring-security/reference/reactive/oauth2/client/index.html

@@java-rush thank you for your reply. I have one more doubt in spring boot 3.2.1 version oauth2 token store is removed right? Is their any replacement of that token store?

@007arek It should. I have not tested that. You can give it a try.

@jyothimammula9154 You don't need these annotations any more. They are enabled by default whenever we have the corresponding dependencies.

@@java-rush what dependecies are used?

@@jyothimammula9154 For OAuth2Client, we need spring-boot-starter-oauth2-client dependency. For OAuth2Resource Server, we need spring-boot-starter-oauth2-resource-server dependency. For OAuth2 Authorization Server, we need spring-boot-starter-oauth2-authorization-server dependency. While creating the project using spring initializer website, you can specify OAuth2 Client, OAuth2 Resource or OAuth2 Authorization Server dependencies.

@@java-rush spring cloud starter oauth2 dependecy is changing in spring 3 version?

@@jyothimammula9154 I am using Spring Boot version 3. If need help setting up the project, you can watch the playlist from beginning or from whatever video you want. From the beginning, I am using Spring Boot 3.1 or 3.2.

I have replied to your commend in this video - ua-cam.com/video/EUyUJQKxlK4/v-deo.htmlsi=yc8jq14g3Tsy0vJC Also checkout this video to understand OIDC logout - ua-cam.com/video/3ucYJaMAgzQ/v-deo.htmlsi=gt6BY3hlFug3B1c8

@aashiyana618 Yes, it is possible. You can have a standalone Angular Application which interacts directly with Authorization Server and Resource Server. But, don't store sensitive information in angular application, like - client secret or anything.

Thanks for watching the video. That's a good use case. I will try to make a video around it.

@@java-rush Thanks for the reply. can you just tell me how to implement this ?

@memsofgamers9479 First of all, in authorization server, you can create custom claims. Each Identity Provider has different ways to do it. I have not used Spring Authorization Server much, so I don't know how to do that with it. But, if you use something like Okta, there you can add additional properties in claims, like role. Then that claim will be available in the access token. In Spring Security Context, you can access that using JwtAuthenticationToken. @PreAuthorize("#token.tokenAttributes.get('role') == 'Admin'") public Map<String, String> postHello( JwtAuthenticationToken token ) { In the above code snippet, the method postHello will be invoked only if the access token has "Admin" as the value of claim "role". Or you can throw custom exception using java code as well. Again, how to set the role claim in token(s) depends on the Identity Provider you are using. For that, you can refer to the documentation of the corresponding provider. Let me know if it helps or if you want to know something else.

Can you explain the question in more details. It is not clear to me.

You're welcome! What was the issue you were facing btw?

@@java-rush aha good question :D I was following an older tutorial on Spring Security and was trying to learn by upgrading it as I went along.. The tutorial was using the old WebSecurityConfigurerAdapter so I was learning by setting up the SecurityFilterChain. The problem was that the frontend was not receiving a CSRF token from the backend, which was caused by the updates in Spring Security 6 (You point this out at around 7:14 in the video). I'm new to the Java + Spring world so i'm missing a lot of context :) In any case you completely solved the problem 🙌 Thanks again!

I will try to create a video regarding this.

Thank you. I am glad you liked it.

Noted. I am using headphone to record the videos. I am planning to get a microphone. If you can suggest good device (microphone or anything), that would be great. I am glad you like the content.

I will create a video related to that for sure.

Glad it was helpful!

That will happen. Since the Authorization Server is same for both clients and you are already logged in to the Authorization Server, next time when you ask for Authorization Code, the Authorization Server uses the session and gives the Authorization Code back. But these codes are different for both clients and when the clients ask for access token using corresponding client secrets and Authorization Code, that will be different as well. This is the expected behaviour as well. For example, when you try to login to any website using Google account you don't login again and again to Google for different applications. But the code you get will be different for each application. I hope this helps. Let me know.

how to logout this session from angular, or logout from angular

It should have worked. I just tried it. My auth server is running on port 8083 and I tried this URL in postman - localhost:8083/oauth2/authorize. You will get an HTML response. Make sure the url is correct in postman (check the port specifically). Let me know whether it works or not.

Thanks for the support.