&state=abc123
# 3. Exchange code for tokens (backend-to-backend)
curl -X POST http://localhost:9000/oauth2/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code&code=&client_id=my-app&client_secret=secret123&redirect_uri=http://localhost:3000/callback"
# Result:
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"id_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"scope": "openid profile email"
}
# 4. Get user info using access token
curl -X GET http://localhost:9000/oauth2/userinfo \
-H "Authorization: Bearer "
# Result:
{
"sub": "1",
"name": "John Doe",
"email": "john@example.com",
"email_verified": true,
"given_name": "John",
"family_name": "Doe",
"groups": ["developers"],
"roles": ["user"]
}
```
### Example 2: Client Application Integration
```javascript
// React Client using OIDC Authorization Code Flow with PKCE
import React, { useEffect } from 'react';
import axios from 'axios';
const OIDC_PROVIDER = 'http://localhost:9000';
const CLIENT_ID = 'my-app';
const REDIRECT_URI = 'http://localhost:3000/callback';
const SCOPES = 'openid profile email';
function LoginButton() {
const handleLogin = () => {
// Generate PKCE parameters
const codeVerifier = generateRandomString(64);
const codeChallenge = generateCodeChallenge(codeVerifier);
const state = generateRandomString(16);
const nonce = generateRandomString(16);
// Store for later validation
localStorage.setItem('pkce_verifier', codeVerifier);
localStorage.setItem('state', state);
localStorage.setItem('nonce', nonce);
// Redirect to OIDC provider
const authUrl = new URL(`${OIDC_PROVIDER}/oauth2/authorization`);
authUrl.searchParams.append('client_id', CLIENT_ID);
authUrl.searchParams.append('redirect_uri', REDIRECT_URI);
authUrl.searchParams.append('response_type', 'code');
authUrl.searchParams.append('scope', SCOPES);
authUrl.searchParams.append('state', state);
authUrl.searchParams.append('nonce', nonce);
authUrl.searchParams.append('code_challenge', codeChallenge);
authUrl.searchParams.append('code_challenge_method', 'S256');
window.location.href = authUrl.toString();
};
return ;
}
function Callback() {
useEffect(() => {
const handleCallback = async () => {
const params = new URLSearchParams(window.location.search);
const code = params.get('code');
const state = params.get('state');
// Validate state
if (state !== localStorage.getItem('state')) {
console.error('State mismatch - possible CSRF attack');
return;
}
try {
// Exchange code for tokens
const response = await axios.post(`${OIDC_PROVIDER}/oauth2/token`, null, {
params: {
grant_type: 'authorization_code',
code: code,
client_id: CLIENT_ID,
client_secret: 'your-client-secret', // NEVER expose in frontend!
redirect_uri: REDIRECT_URI,
code_verifier: localStorage.getItem('pkce_verifier')
}
});
const { access_token, id_token } = response.data;
// Decode and verify ID token
const idTokenDecoded = decodeToken(id_token);
if (idTokenDecoded.nonce !== localStorage.getItem('nonce')) {
console.error('Nonce mismatch');
return;
}
// Store tokens
localStorage.setItem('access_token', access_token);
localStorage.setItem('id_token', id_token);
localStorage.setItem('user', JSON.stringify(idTokenDecoded));
// Redirect to dashboard
window.location.href = '/dashboard';
} catch (error) {
console.error('Token exchange failed:', error);
}
};
handleCallback();
}, []);
return Processing login...;
}
function Dashboard() {
const user = JSON.parse(localStorage.getItem('user'));
return (
Welcome, {user.name}
Email: {user.email}
Groups: {user.groups.join(', ')}
);
}
```
---
## Key Differences: Authelia vs Custom Spring Boot IDP
| Aspect | Authelia | Spring Boot IDP |
|--------|----------|-----------------|
| **Architecture** | Reverse proxy companion | Standalone service |
| **Session Management** | Cookie-based via reverse proxy | Token-based (JWT) |
| **Integration** | Forward Auth protocols | OIDC/OAuth2 standard |
| **User Storage** | LDAP, Files, Database | Database (custom) |
| **2FA Support** | Built-in (TOTP, WebAuthn, Duo) | Must implement |
| **Complexity** | Low - configuration based | High - code based |
| **Scalability** | Lightweight (< 30MB) | Standard Spring Boot |
| **Use Case** | Quick SSO for internal apps | Custom IDPwith business logic |
---
## Security Best Practices for Your IDP
1. **Always use HTTPS** for all endpoints
2. **Rotate JWT secrets** regularly
3. **Implement rate limiting** on login/token endpoints
4. **Use strong password hashing** (BCrypt, Argon2)
5. **Validate redirect URIs** strictly
6. **Implement PKCE** for public clients
7. **Use short expiration times** for authorization codes
8. **Store client secrets** securely (encrypted in database)
9. **Implement CORS** properly
10. **Log security events** (failed logins, token issuance)
---
## References
- [OpenID Connect Specification](https://openid.net/connect/)
- [OAuth 2.0 RFC 6749](https://tools.ietf.org/html/rfc6749)
- [JWT RFC 7519](https://tools.ietf.org/html/rfc7519)
- [Authelia Documentation](https://www.authelia.com/)
- [Spring Security OAuth2](https://spring.io/projects/spring-security-oauth2-resource-server)