Spring Security integrates with OAuth2 by offloading both authentication and authorization to a dedicated authorization server, then using the tokens that server issues to make access decisions inside the application.
Key Points: • Authentication happens once against the OAuth2 server; the app never sees the user's password. • The authorization server issues an access token (and often an ID token/refresh token) after successful login. • Spring Security validates the token on each request and derives GrantedAuthority values from its scopes or claims. • Centralizing identity in one server simplifies single sign-on across multiple microservices. • Token expiration and refresh handling keeps sessions secure without long-lived credentials.
Example: An internal dashboard configured with oauth2Login() redirects unauthenticated users to the company's identity provider, then stores the returned token so subsequent calls to internal APIs are authorized automatically.
Interview Tip: A concise interview answer is:
"Spring Security integrates OAuth2 by redirecting authentication to an external authorization server and then using the access token it issues to authorize subsequent requests. This centralizes login logic in one trusted service instead of duplicating credential handling across every application."