Recorded at SpringOne2GX 2013 in Santa Clara, CA.

Speaker: Dr. David Syer

The OAuth2 specification (wisely) leaves a lot of areas open to interpretation and implementation details, so there are a lot of opportunities to impose interpretations on the flows and the underlying data. This presentation starts with a basic guide to the main features of OAuth2 and then goes on to show, with examples, how they can be exploited to support business and application use cases. For instance, should you encode access decision data directly in the access token, or make the token completely opaque? Should you be signing requests? What naming convention should you use for OAuth2 scopes? How do you go about registering users and clients? There are some obvious patterns in existing OAuth2 implementations, and Spring Security OAuth provides plenty of hooks and extension points should you wish to copy one of those, or make your own rules. Examples will use Spring and Spring Security to show how to take advantage of the inherent flexibility, both in the spec and in the libraries. Learn more about Spring Security OAuth: http://projects.spring.io/spring-security-oauth and Spring Security: http://projects.spring.io/spring-security

!{iframe width="420" height="315" src="//www.youtube.com/embed/nMdtYnSXRpw" frameborder="0" allowfullscreen}{/iframe}