Using Spring Authorization Server

In the past, I’ve used Keycloak as the security service. The API gateway used an OAuth password grant type to authenticate the client’s credentials with Keycloak and obtain a JWT. The backend services obtained the public key from Keycloak via its JWKS endpoint.

But for a recent project, I decided to use Spring Authorization Server. However, I ran into a problem: Spring Authorization Server doesn’t support the password grant type. That’s because the password grant type is removed from the OAuth 2.1 specification. It’s considered insecure because requires the application to handle the human user’s credentials, which defeats the purpose of OAuth.

Adding password grant type to Spring Authorization Server

While password grant is insecure for human users, it still seemed a good fit my API gateway scenario. After all, the API Gateway is part of the application that issued the client’s credentials. Consequently, I decided to add the password grant type to Spring Authorization Server. A quick Google search discovered a code sample on StackOverflow that I was able to adapt to a new version of Spring Authorization Server.