What is the replacement for the deprecated AuthorizationServer in Spring Security?
Spring Security 5.2.2 has incorporated Spring Security OAuth project, but not AuthorizationServer or ResourceServer. What are the replacements to AuthorizationServer in Spring Security 5.2.2?
This document contains guidance for moving OAuth 2.0 Clients and Resource Servers from Spring Security OAuth 2.x to Spring Security 5.2.x. Since Spring Security doesn’t provide Authorization Server support, migrating a Spring Security OAuth Authorization Server is out of scope for this document.
Answer
The first thing to note is that Spring Security OAuth 2.4.0 officially deprecates all its classes.
The second thing is that according to the Spring Security - OAuth 2.0 Features Matrix - FAQ:
We are no longer planning on adding Authorization Server support to Spring Security.
One solution is to use an OAuth2 authorization server such as Gluu or Keycloak, but depending on your usage and on the degree of customization you have made in your authorization server this is certainly not straightforward.
Due to Spring community protests, there is also some hope that an authorization server will still be implemented in Spring Security. According to Josh Cummings on Github :
We'd like to thank everyone for your feedback on the decision to not support Authorization Server. Due to this feedback and some internal discussions, we are taking another look at this decision. We'll notify the community on any progress.
See also : https://spring.io/blog/2019/11/14/spring-security-oauth-2-0-roadmap-update
== Update 5 March 2020 ==
To answer the question of Joseph: "Any issue if we continue using it?": For now, no specific issues, Spring Security OAuth is still maintained but this will probably not be the case in a near future. Citing the same blog post as above:
The 2.3.x line will reach EOL in March 2020. We will support the 2.4.x line at least one year after reaching feature parity.
To that end, with the release of Spring Security 5.2, we are strongly encouraging users to start migrating their legacy OAuth 2.0 client and resource server applications to the new support in Spring Security 5.2.
== Update 15 April 2020 ==
A brand new Spring Authorization Server is announced. You can find it on Github.
== Update 7 May 2020 ==
As announced on the Spring blog:
To that end, the plan is to provide patch and security fixes for the Spring Security Oauth 2.4.x and 2.5.x line until May 2021. Additionally, security fixes will be supported for the 2.5.x line until May 2022, at which point the project will have reached end-of-life.