This repository hosts a sample project on OAuth & OIDC Authorization Code Flow with PKCE that comprises of an Angular & Polymer based SPA (Single Page App) client, Spring Boot based resource server, Keycloak authorization server and an OpenLDAP based directory server.
This is a PoC for the Linkedin Blog: Single Page Application Security with OAuth and OpenID Connect
The project relies on OAuth & OIDC Authorization Code Flow with PKCE that is the recommended method to use for SPA clients instead of implicit flow:
The libraries/solutions in place are in Certified OpenID Connect Implementations list:
- Client: Two alternatives are available for use:
- Authorization Server: Keycloak
The basic project architecture is as follows (in Archimate standard):
