OAuth2 and OIDC Questions

What is OAuth2? Name the four roles.

OAuth2 is an authorization framework that lets an app access resources on behalf of a user without seeing the user's password.

Role	Example
Resource owner	the user
Client	ShopEase React app / backend
Authorization server	Google, Keycloak, Auth0, Spring Authorization Server
Resource server	ShopEase API that accepts access tokens

What is the difference between OAuth2 and OpenID Connect?

OAuth2 is about delegated authorization (an access token for an API). OpenID Connect is a layer on top of OAuth2 for authentication: requesting the openid scope returns an ID token (a JWT with sub, email, name) and gives a /userinfo endpoint. "Login with Google" is OIDC.

Which OAuth2 grant types should you use today?

Grant	Use
Authorization Code + PKCE	users logging in from web, SPA and mobile apps
Client Credentials	service-to-service calls, no user involved
Refresh Token	getting new access tokens without re-login
Implicit, Password	deprecated; removed in OAuth 2.1, do not use

oauth2Login vs oauth2ResourceServer: what is the difference?

oauth2Login() makes your app an OAuth2 client: it redirects the browser to Google/Keycloak, handles the callback and creates a session. oauth2ResourceServer().jwt() makes your API a resource server: it does not log anyone in, it only validates the Bearer token on each request.

Resource server config

A resource server only needs the issuer; keys are fetched from its JWK Set URI.

application.yml

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://auth.shopease.in/realms/shopease

Scopes from the token become SCOPE_ authorities. How do you map Keycloak roles instead?

@Bean
JwtAuthenticationConverter jwtAuthenticationConverter() {
    JwtGrantedAuthoritiesConverter roles = new JwtGrantedAuthoritiesConverter();
    roles.setAuthoritiesClaimName("roles");   // claim holding ["ADMIN","USER"]
    roles.setAuthorityPrefix("ROLE_");
    JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
    converter.setJwtGrantedAuthoritiesConverter(roles);
    return converter;
}

By default a token with scope: "orders.read" gives the authority SCOPE_orders.read. Keycloak puts roles in a nested realm_access.roles claim, which usually needs a small custom Converter<Jwt, Collection<GrantedAuthority>>.