Full Security Login System with Spring Boot

This project contains all the configuration about an authentication and authorization system. We are using spring boot framework, spring security, spring oauth token and mysql. Cause we want ours projects be scalable as they can we are using the JWT token key for authentication with oauth2, this means that we don’t need sessions and session storage system so our application will work faster and better even in cloud server without any configuration.

Features

User Auhtentication

User Authorazation

Account Registration

Forgot Password (Not Ready yet)

The concept of OAuth2 authentication and JWT

OAuth1

OAuth1 has 3 steps and one loop. Check the diagram bellow and you will understand what we define as step and loop.

loop: We can say that a loop is a request between client and server

step: As a step we define the blocks of algorithm “mythology”

In login system client and server have to follow those steps

Sent the username and password to server via post request
server will send to the client the access token
client now have to store the access token into cookies or local storage

When client now want to get all products (for example)

Client should send the access token as header parameter
server parse all request the check if the header access token field is correct
then return all products

OAuth2

OAuth2 is more complex that OAuth, it has 3 loops and 3 steps in each loop.

In the first loop

client send the username and the password throw get request
server return the refresh token. Refresh token is something that give the ability to user to request for re access token. The main difference between them are that the refresh token exist for a lot longer and but the access token is the only one that give to you the ability to have real access to the application.
client get the refresh token and have to store it to cookies or local storage

The second loop

client is ready to request for an access token, so it sends to server a get request with the refresh token to get the access token.
server check for the refresh token and if this is correct then
return to client the access token

The third loop

Now user have to send the access token via get or as header parameter
Server analyze the access token and if this is correct then
return the request to user

Database

As database we are using the MySql, if you want to run the project you want edit the resource/config/application.properties file and add your database settings. After that import the databse.sql file that exists in root directory

How to run it

First Download the project
Install all Maven Dependencies
Edit the resource/config/application.properties file and add your properties (Mysql Database, Gmail - Email Sender)
After that import the Databse.sql file that exists in root directory
Run the project by spring-boot:run agian

How to use it

To run this example you must import the databse file that exists in root directory

-First ask for a access token curl -X POST -vu clientapp:123456 http://localhost:8080/oauth/token -H "Accept: application/json" -d "password=papidakos123&username=papidakos&grant_type=password&scope=read%20write&client_secret=123456&client_id=clientapp"

-Now Try with postman get data from secure api uri. Don't forget to replace the headers token with your access token

The project has been created with Intelli IDEA IDE

pervez8ktt/Spring-Boot-OAuth2-JWT-MySQL