Sign up for an{" "}
Auth0 account
{" "}
or{" "}
console.log("log in")}>
log in
{" "}
to your existing account to integrate directly with your own tenant.
;
};
export const sections = [{
id: "configure-auth0",
title: "Configure Auth0"
}, {
id: "configure-sprint-boot-application",
title: "Configure Sprint Boot application"
}, {
id: "configure-spring-security",
title: "Configure Spring Security"
}, {
id: "add-login-to-your-application",
title: "Add login to your application"
}, {
id: "add-front-page",
title: "Add front page"
}, {
id: "add-controller",
title: "Add controller"
}, {
id: "add-logout-to-your-application",
title: "Add logout to your application"
}];
This tutorial uses [Spring MVC](https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html). If you are using [Spring WebFlux](https://docs.spring.io/spring/docs/current/spring-framework-reference/web-reactive.html#spring-web-reactive), the steps to add authentication are
similar, but some implementation details are different. Refer to the [Spring Boot WebFlux Sample Code](https://github.com/auth0-samples/auth0-spring-boot-login-samples/tree/master/webflux-login) to see how to integrate
Auth0 with your Spring Boot WebFlux application.
To use Auth0 services, you’ll need to have an application set up in the Auth0 Dashboard. The Auth0 application is
where you will configure how you want authentication to work for the project you are developing.
### Configure an application
Use the interactive selector to create a new Auth0 application or select an existing application that represents
the project you want to integrate with. Every application in Auth0 is assigned an alphanumeric, unique client ID
that your application code will use to call Auth0 APIs through the SDK.
Any settings you configure using this quickstart will automatically update for your Application in the [Dashboard](https://manage.auth0.com/#/), which is where you
can manage your Applications in the future.
If you would rather explore a complete configuration, you can view a sample application instead.
### Configure Callback URLs
A callback URL is a URL in your application that you would like Auth0 to redirect users to after they have
authenticated. If not set, users will not be returned to your application after they log in.
If you are following along with our sample project, set this to
`http://localhost:3000/login/oauth2/code/okta`.
### Configure Logout URLs
A logout URL is a URL in your application that you would like Auth0 to redirect users to after they have logged
out. If not set, users will not be able to log out from your application and will receive an error.
If you are following along with our sample project, set this to
`http://localhost:3000`.
### Add Spring dependencies
To integrate your Spring Boot application with Auth0, include the [Okta Spring Boot
Starter](https://github.com/okta/okta-spring-boot/) in your application's dependencies.
This guide uses [Thymeleaf](https://www.thymeleaf.org/) and the [Spring Security integration module](https://github.com/thymeleaf/thymeleaf-extras-springsecurity) for the view layer. If you are using
a different view technology, the Spring Security configuration and components remain the same.
If you're using Gradle, you can include these dependencies as shown below.
```text lines
plugins {
id 'java'
id 'org.springframework.boot' version '3.1.4'
id 'io.spring.dependency-management' version '1.1.3'
}
implementation 'com.okta.spring:okta-spring-boot-starter:3.0.5'
implementation 'org.springframework.boot:spring-boot-starter-web'
implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity6'
implementation 'nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect'
```
If you are using Maven:
```xml lines expandable
org.springframework.bootspring-boot-starter-parent3.1.4com.oktaokta-spring-boot-starter3.0.5org.springframework.bootspring-boot-starter-weborg.springframework.bootspring-boot-starter-oauth2-clientorg.springframework.bootspring-boot-starter-thymeleaforg.thymeleaf.extrasthymeleaf-extras-springsecurity6nz.net.ultraq.thymeleafthymeleaf-layout-dialect
```
The Okta Spring Boot Starter makes it easy to configure your application with Auth0. The sample below uses an
`application.yml` file, though you can also use properties files or any of the other [supported externalization mechanisms](https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#boot-features-external-config).
```yml lines
#src/main/resources/application.yml
okta:
oauth2:
issuer: https://dev-gja8kxz4ndtex3rq.us.auth0.com/
client-id: mz9iNEIo2PHu7oeh8QRt19ndTyyCIgai
client-secret: yLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
#The sample and instructions above for the callback and logout URL configuration use port 3000.
#If you wish to use a different port, change this and be sure your callback and logout URLs are
#configured with the correct port.
server:
port: 3000
```
To enable user login with Auth0, create a class that will register a [SecurityFilterChain](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/web/SecurityFilterChain.html), and add the `@Configuration`
annotation.
You can configure the [HttpSecurity](https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/config/annotation/web/builders/HttpSecurity.html) instance to require authentication on all
or certain paths. For example, to require authentication on all paths except the home page:
```java lines
http.authorizeHttpRequests(authorize -> authorize
.requestMatchers("/").permitAll()
.anyRequest().authenticated()
);
```
The Okta Spring Boot Starter will use the client configuration you defined earlier to handle login when a user
visits the `/oauth2/authorization/okta` path of your application. You can use this to create a login
link in your application.
This page returns the user attributes when the user authentications. You will use the `/logout` link
in the template to implement the logout feature.
Create a controller to handle the incoming request. This controller renders the `index.html` page.
When the user authenticates, the application retrieves the users's profile information attributes to render the
page.
##### Checkpoint
When you click the login link, verify the application redirects you to the [Auth0 Universal Login](https://auth0.com/universal-login) page and that you can
now log in or sign up using a username and password or a social provider.
Auth0 enables the Google social provider by default on new tenants and offers you developer keys to
test logging in with [social identity providers](https://auth0.com/docs/connections/identity-providers-social). However, these developer keys have some limitations
that may cause your application to behave differently. For more details on what this behavior may look
like and how to fix it, consult the [Test Social Connections with Auth0 Developer Keys](https://auth0.com/docs/connections/social/devkeys#limitations-of-developer-keys) document.
Now that users can log into your application, they need [a way to log out](https://auth0.com/docs/logout/guides/logout-auth0). By default, when
logout is enabled, Spring Security will log the user out of your application and clear the session. To enable
successful logout of Auth0, you can provide a `LogoutHandler` to redirect users to your [Auth0 logout endpoint](https://auth0.com/docs/api/authentication?javascript#logout)
(`https://{yourDomain}/v2/logout`) and then immediately redirect them to your application.
In the `SecurityConfig` class, provide a `LogoutHandler` that redirects to the Auth0 logout
endpoint, and configure the `HttpSecurity` to add the logout handler
##### Checkpoint
When you click logout link, the application should redirect you to the address you specified as one of
the "Allowed Logout URLs" in the "Settings" and you are no longer logged in to your application.
## Next Steps
Excellent work! If you made it this far, you should now have login, logout, and user profile information running in your application.
This concludes our quickstart tutorial, but there is so much more to explore. To learn more about what you can do with Auth0, check out:
* [Auth0 Dashboard](https://manage.auth0.com/dashboard/us/dev-gja8kxz4ndtex3rq) - Learn how to configure and manage your Auth0 tenant and applications
* [Okta Spring Boot Starter SDK](https://github.com/okta/okta-spring-boot/) - Explore the SDK used in this tutorial more fully
* [Auth0 Marketplace](https://marketplace.auth0.com/) - Discover integrations you can enable to extend Auth0’s functionality
```yml application.yml lines
okta:
oauth2:
issuer: https://dev-gja8kxz4ndtex3rq.us.auth0.com/
client-id: mz9iNEIo2PHu7oeh8QRt19ndTyyCIgai
client-secret: yLTW7npKO4g1HHsCENiZbOaHHXLmhVefJxdNnXcyhOBOomZ2tgjJjSC2pMK7Swvr
```
```java SecurityConfig.java lines
package com.auth0.example;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2Login(withDefaults());
return http.build();
}
}
```
```html index.html lines
Sign up for an{" "}
Auth0 account
{" "}
or{" "}
console.log("log in")}>
log in
{" "}
to your existing account to integrate directly with your own tenant.