springspring-bootjava-17spring-security-6

How can I use an Angular login instead of Spring Security's login for my OAuth2 server?


I have a microservices architecture with Spring Boot 3 and Spring Security 6, Java 17. I have implemented an OAuth2 server for authentication and authorization of the application, which I have hooked up to the API gateway. The integration is ready, but now I have encountered the problem that I don't know how to decouple the server's login. What I mean is, I have an Angular client with its own login, and I want to use that instead of the one provided by Spring Security. However, I don't see a possible way to generate the code, etc. Nor do I know where to make a POST request for the username, password, etc. How can I make it independent of Spring Security's login and decouple the login to use one made with Angular? Thank you very much in advance. Regards.


Solution

  • What you request would use OAuth2 flows which were deprecated for good reasons.

    You should not be trying to do that: Angular app should not have access to user credentials, because of OAuth2 standard evolution, not of Spring Security limitation.

    One of the points in the decoupling you are referring to, is to remove everything related to authentication mechanisms from OAuth2 clients and resource servers (only authorization server is concerned).

    To go even further, if you have a gateway configured as an OAuth2 client, the Angular app isn't involved in OAuth2 at all! (it is secured with a session on the gateway, and doesn't communicate with authorization server nor accesses authorization-code or tokens).

    If the concern is look & feel, style your authorisation server login screens instead (almost every authorization server on the market has features to customize its appearance).