Careeroza
Introduction
What It Is
Spring Authorization Server (SAS) is the official Spring project for building your own OAuth 2.1 / OpenID Connect provider — the same job Keycloak, Auth0 and Okta do. It is a set of Spring Security filters, so you configure it with beans like the rest of your app.
| Option | Choose it when | Watch out |
|---|---|---|
| Keycloak (self-hosted) | You want a full product with admin UI, user federation (LDAP), social login | Another system to run, upgrade and back up |
| Auth0 / Okta / Cognito | You want zero operations and pay per user | Cost grows with users; vendor lock-in |
| Spring Authorization Server | You need full control in Java: custom login (OTP), custom claims, your own user tables | You build user management screens yourself |
Endpoints You Get
| Endpoint | Purpose |
|---|---|
/oauth2/authorize | Start the authorization-code flow (login + consent) |
/oauth2/token | Exchange code / refresh token / client credentials for tokens |
/oauth2/jwks | Public keys that resource servers use to verify tokens |
/.well-known/openid-configuration | OIDC discovery document |
/oauth2/introspect, /oauth2/revoke | Token introspection (RFC 7662) and revocation (RFC 7009) |
/userinfo, /connect/logout | OIDC user info and RP-initiated logout |