Subject: [OAUTH-WG] Authorization Server

From: Richard Snowden <[email-masked]>
Date: Thu, 17 Jul 2014 10:47:11 +0200

Hi there,

after viewing some tutorials and running some samples code I understood the
client side of OAuth 2.0.

Using existing Authorization Server seems to be not too complicated.

Question is: How to implement my own Authorization Server?

Since many companies have their own User/Privilege system, LDAP based (e.g.
Active Directory), etc. - they must have their own Authorization Server.

Is there a framework, libraries, etc. for that? Or do I have to write the
code from scratch?

cheers,
Richard

---

From: Buhake Sindi <[email-masked]>
Date: Fri, 18 Jul 2014 02:12:40 +0200

Hi Richard,

I had the same dilemma. Most write their own Authorization server. Pretty soon, once I complete it officially, my company will release a Java library to configure an OAuth Authorization server (as many have written me emails requesting of such library). I don't know if there is an existing one yet, probably Spring Framework has?

Kind Regards,

Buhake Sindi
www.sindi.co.za

On 17 Jul 2014, at 10:47, Richard Snowden <[email-masked]> wrote:

> Hi there,
> 
> after viewing some tutorials and running some samples code I understood the client side of OAuth 2.0.
> 
> Since many companies have their own User/Privilege system, LDAP based (e.g. Active Directory), etc. - they must have their own Authorization Server.
> 
> Is there a framework, libraries, etc. for that? Or do I have to write the code from scratch?
> 
> cheers,
> Richard
> _______________________________________________
> OAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/oauth

---

From: Justin Richer <[email-masked]>
Date: Thu, 17 Jul 2014 20:15:43 -0400

Richard,

Many people implement their own servers and tie it closely to their 
protected resource API. There are a number of general purpose 
authorization servers and libraries out there, though, including an open 
source one written in Java that I maintain:

https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server/

It's based on Spring and Spring Security, and it also includes OpenID 
Connect support. Additionally, it implements JWT bearer tokens, 
revocation, introspection, dynamic registration, and it has an admin 
interface.

  -- Justin

On 7/17/2014 4:47 AM, Richard Snowden wrote:
> Since many companies have their own User/Privilege system, LDAP based 
> (e.g. Active Directory), etc. - they must have their own Authorization 
> Server.
>