OAuth2

1 / Delegated Authorization

OAuth2 provided delegated authorization in Trajectory, allowing users to authenticate through external identity providers — Google OAuth and GitHub OAuth — without the application managing passwords directly. The authorization code flow handled the redirect-based authentication sequence, exchanging authorization codes for access tokens and establishing local application sessions.

2 / Implementation

Integrating OAuth2 with Spring Security required configuring the authorization server endpoints, client credentials, and scope definitions. The callback handler exchanged authorization codes for tokens, extracted user profile information, and either created new local accounts or linked to existing ones. Scope management controlled what profile information the application could access from the identity provider.

3 / Practical Lesson

The most important lesson with OAuth2 was separating authentication (who is this user?) from authorization (what can this user do?). OAuth2 handles authentication through the identity provider, but Role-Based Access Control handles authorization within the application. Conflating the two creates security gaps where authenticated users can access resources beyond their permission level.