Now we have the client and client secret token in our hand, which we got during the restoration of
the client application with the GitHub or two.
So now let's try to understand what are the changes that we have to make inside any spring application
or springboard application if you want to use spring security framework to leverage or to framework
during the lodging of the application.
So for the same first we have to add this dependency inside Pontotoc symbol, since in this application
I'm just going to consume the server which is built outside my application.
I have to use only or to clanked.
But if we have a scenario where you want to build the orzo by use and you can also import the dependency
which is related to or to Ottowa, but now you can see we import only what the client, which is good
enough in our scenario.
And other than that, we should also import other basic dependencies like springboard starter security
and springboard starter.
So these dependencies will add all the required libraries that we need inside our spring application.
And you can see this is the springboard application.
And we have this is the main class with the name Spring Security or GitHub.
I also have project configuration to use spring security.
I'll come to this class again before that.
In my project, I have only a single resta controller with the pad slash like if you can remember inside
the GitHub registration, we have given that the redirect to working as localhost adat.
So we know that redirection happened.
The request will come here and I made this party secured inside my configurations.
Once authentication is successful, I'll be redirect to say goodbye to Yemen and secure that his team
will simply displace successfully log in using GitHub.
You can assume this secured attachment is a protected resource being inside my server.
But if someone want to use this particular resource, they have to complete the login into my application.
Using the GitHub ought to and at the same time, after successful login for a reference purpose.
I'm also printing all the details that we are getting from the GitHub as well.
Like my name, my email, my repository details, all those details will be getting from the GitHub
or to somewhere.
So I'm not using them here for our reference, I'm just printing it.
If you go and check the configuration class, you can see this does bring security configuration class
and we are already configured method.
And all this, you know, has to be addressed request.
I'm saying any request inside this application has to be authenticated.
In this scenario, I have only one based to control, which is secure controller, and it has to be
authenticated.
And the login type that I want to use is the order to login.
Like we have different type of logins like headstock to be basic form login and or to login is the other
type of login that we are indicating inside our application, saying that I am going to leverage our
two framework due to that we are mentioning or to login here.
So whenever we add this auto log in here, it will add a filter inside our security flow, which is
what to login authentication for.
Now we may configurations inside configure method to indicate that our secure control is a secured service
and everyone has to be authenticated using or to log in.
Now the next step is for hour or two.
There are different components in one user client server and this also.
So in this scenario, that is also what is this application itself and the resources that has secured
the kids team and the user?
A resource owner is me.
Whenever I try to access the secured attachment, I'll be asked to use my GitHub credentials to prove
my identity by redirecting to that GitHub.
You are an obviously client.
We have to register inside our application so that the client a little secret will be sent to the Observer
by this application.
Once we restart the client, we should also tell to our application which observer I am using related
to GitHub or Google or any other orzo.
So we have to provide those server endpoint details, all those details as well for the same.
First, we have to list the client details inside this application so that the client ID and client
secret will be leveraged by the application minorities' interacting with the ATO.
So there are three different ways on how we can register the client details.
The very first Anlong approach is this one.
Whatever you see the commenter, Kahir.
I just uncommented for your reference, you had to write a letter with the name Client Registration,
and there is a client registration class available inside the spring security framework.
In this client registration class, you have to pass the registration.
So registration is something which indicates which companies or which organization alteration.
Sahlberg, that I am going to use.
So in this instance, since I'm going to use a GitHub Utsav, I'm just mentioning this traditionally
as you type and claimed it is the value that we get during our registration and client secret.
Also we get during our restriction scope like what are the scopes that we want to use, like whether
to read or write and what is the attribution you are and what is the endpoint of the observer belongs
to GitHub and what is a token you are.
I like to get the access token and use info.
You are right to get the details of the user and what is a clean name that we have given for our client
application.
And so the GitHub website and what the attraction grandpap that we want to use.
And you can see here this operation Grandpap has five different type of grant types.
One is alteration or implicit refresh client credentials and password, which is same as resource one
password Cantrell's.
And as we discussed, implicit is the one which is getting replicator.
So don't use that.
We should always use any of the other four and redirect.
You are allowed so we can mention.
But you can see here there is a lot of configuration involved with this first approach.
So due to this reason, most of the folks there do not use this.
But this approach is useful whenever you are building the observer inside your organization only.
But if we have a scenario where you are using the most common answer was available in the industry,
like GitHub, Google, Facebook, then there is a simple approach where you just have to create a little
time restriction and leverage the common work to provide it.
So this is the common or to provide is a class which is provided by the spring security framework team
itself by constructing the most common or two servers that we are going to use.
You can see here for Google, they put all the configuration details.
What is the token?
You are what is alteration?
You are in everything, even for GitHub, Facebook and Okta.
So since all these details are available inside the framework, you don't have to take the pain of configuring
again.
So you just mentioned what is the odds are that you are going to use like GitHub or Google and you call
get builder with the registrational as GitHub and claimed it, you'll pass the value that will go along
with the client secret and eventually will call the build method.
So this will return a client presentation.
Once we have this client registration values available, you should also create a client registration
repository.
Client registration repository is same as our user detail service that we discussed previously in normal
authentication flow.
In the same way, in order to flow, we have a client registration repository which have a method defined
by registration eighty.
So this method will use the registration eighty to get the client registration details that we configured.
Like I configure GitHub, I configure Google.
So based upon the institutionality at the runtime, it will get the client registration details by leveraging
the values that we can forget inside this matter.
And again, client registration repository, we can go with in-memory client restriction repository,
very client registration repository.
But now I'm using here in memory client registration repository.
For that you have to pass the client registration.
Previously you configure here.
So since I'm keeping that, there had been so my framework is smart enough to detect, OK, I have a
client registration repository, how to use these with the in-memory client registration repository
along with the configurations provided by the user under the method client registration.
So again, this is also a and at that second approach.
But if we have a scenario where I don't want to take all this pain and I want my client registration
and client restriction repository to be auto configured by the spring board, you can still simply go
to the application that properties and mention these two values.
So here you are indicating that you are going to use GitHub and this is the client ID and clients.
So whenever you mention these properties inside your application that properties your springboard is
smart enough to create a client registration based upon this client data and client secret.
And it also creates a bean client registration repository for you.
But again, this is only for GitHub.
But if we have a Facebook, you just replace the GitHub value with the Facebook.
Are Google in this location?
You can also have a lot of properties that you can configure inside application that properties which
you can always identify and use them by going through the spring security documentation.
So I'll just show you that we can go to the spring security documentation website.
So this is the wall like spring security.
I'm just seeing the dogs of 5.2 TotEx and or two dogs and looking so you can see here if you scroll
down.
So these are all the properties that we can use in order to register or to details inside the property
file itself.
You don't have to manually create the client registration and client registration repository, but you
can always leverage all these properties.
So now we have done done enough configurations inside our application in the next lecture.
Let's try to start our application and see how our configurations, two or two is working by logging
into the application.
Thank you.
And see you next by.