3735023 - Moving to the New OAuth Implementation in JDK21: OAuth Implementation Architecture and Technical Guide

In this release, the oauth2 extension has been removed and replaced with a new OAuth implementation that comes with the new authorizationserver, resourceserver, and oauth2commons extensions. The changes are a result of moving the OAuth functionality from the Spring Security OAuth 2.5.x library that reached its EOL in May 2022 to Spring Security 6.x. As Spring Security isn't fully compatible with Spring Security OAuth, a few changes have been made to the OAuth implementation that required creating new extensions and adjusting their configuration to what is supported in Spring Security. 

These changes may result in incompatibility between the customized code based on the old OAuth version and the new OAuth implementation. Therefore, understanding these technical details is beneficial for troubleshooting the issues and difficulties encountered. This article introduces the technical details of new OAuth implementation in the SAP Commerce JDK 21 versions. 

Before jumping to the below topics, please pay attention to the OAuth official document: The OAuth 2.0 Authorization Framework. Certainly, the OAuth2 implementation consists of two separate modules in SAP Commerce Cloud: the Authorization Server and the Resource Server, which communicate through the Event Service as below:

KBA , CEC-SCC-PLA-PL , Platform , Problem