Add Spring dependencies

Spring Boot provides a spring-boot-starter-oauth2-client starter, which provides all the Spring Security dependencies needed to add authentication to your web application.

If you're using Gradle, you can include these dependencies as shown below.

plugins {
    id 'java'
    id 'org.springframework.boot' version '2.5.12'
    id 'io.spring.dependency-management' version '1.0.9.RELEASE'
}

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
    implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
    implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity5'
}

If you are using Maven:

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.5.12</version>
    <relativePath/>
</parent>

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-client</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <dependency>
        <groupId>org.thymeleaf.extras</groupId>
        <artifactId>thymeleaf-extras-springsecurity5</artifactId>
    </dependency>
</dependencies>

Spring Security makes it easy to configure your application for authentication with OIDC providers such as Auth0. In your application's configuration, configure the OAuth2 client and provider. The sample to the right shows an application.yml file, though you can also use properties files or any of the other supported externalization mechanisms.

To enable user login with Auth0, create a class that will provide an instance of SecurityFilterChain, and add the @EnableWebSecurity annotation.

Later in this quickstart, you will overwrite this file with SecurityConfigWithLogout.java to provide extra configurations to support the logout feature.

http.authorizeRequests()
      .mvcMatchers("/").permitAll()
      .anyRequest().authenticated()
      .and().oauth2Login();

Spring Security uses the client configuration you defined earlier to handle login when a user visits the /oauth2/authorization/auth0 path of your application. You can use this to create a login link in your application.

This page returns the user attributes when the user authentications. You will use the /logout link in the template to implement the logout feature.

Create a controller to handle the incoming request. This controller renders the index.html page. When the user authenticates, the application retrieves the users's profile information attributes to render the page.

Now that users can log into your application, they need a way to log out. By default, Spring Security logs user out of your application and clears the session when you enable logout. To enable successful Auth0 logout, extend the SecurityContextLogoutHandler class to redirect users to your Auth0 logout endpoint (https://{yourDomain}/v2/logout) and then immediately redirect them to your application.

Next, update your implementation of SecurityFilterChain to register your logout handler and specify the request path that should trigger logout (/logout in the example below).

You can remove the SecurityConfig.java and replace it with SecurityConfigWithLogout.java or update the contents from the one file to another.