Learn to use Oauth2 to add third-party authentication in Spring web applications.

Web Authentication and Authorization

This module will show you what Oauth2 is, why it's important, and how to use it effectively. We'll start with an overview of Oauth2 in general and then explore its different types of grants, including password, authorization, refresh token, and more. All these concepts are backed by hands-on exercises. We'll get to practice creating cross-origin resource sharing policies and custom user-principal. We’ll also learn about the configuration of the authorization server to send login credentials via JSON. By the end of this module, we will have the foundations to add a proper authentication system to our application.

Oauth2 with Spring Security

## Different kinds of grants

An authorization grant is where an OAuth2 client is given access to a protected resource using the OAuth2 protocol.

There are many kinds of grants including:
- Authorization Code

- Implicit
- Password
- Client Credentials
- Device Code
- Refresh Token

Amongst these, the safest and most used are the **password**, the **authorization code**, and the **refresh token grants**.

## Password grant
By using the “password grant” type of authorization, the user will have to verify their identity through a *username* and *password*. In return, the server will return a JSON Web Token (JWT) if the data provided is correct. This token will have some default fields. However, you are free to add custom information to it.

> **Note**: The method used to return the JWT the first time, and to send the token bearer is already set, allowing you to take a few architectural decisions off your shoulders.

The diagram below shows how communication takes place when using the password grant.


# Different kinds of grants

An authorization grant is where an OAuth2 client is given access to a protected resource using the OAuth2 protocol.

There are many kinds of grants including:
- Authorization Code

- Implicit
- Password
- Client Credentials
- Device Code
- Refresh Token

Amongst these, the safest and most used are the **password**, the **authorization code**, and the **refresh token grants**.

# Password grant
By using the “password grant” type of authorization, the user will have to verify their identity through a *username* and *password*. In return, the server will return a JSON Web Token (JWT) if the data provided is correct. This token will have some default fields. However, you are free to add custom information to it.

> **Note**: The method used to return the JWT the first time, and to send the token bearer is already set, allowing you to take a few architectural decisions off your shoulders.

The diagram below shows how communication takes place when using the password grant.


In this lesson, you will get acquainted with the different types of grants and get a deep understanding of password grants.

Theory

Practice

Conclusion

Password Grant

Different kinds of grants