Add some oauth2 configuration and sample code

2025-01-27 15:45:14 +00:00
parent fe207e5c72
commit c13369e6db
29 changed files with 1788 additions and 8 deletions
--- a/samples/grpc-oauth2/README.md
+++ b/samples/grpc-oauth2/README.md
@@ -0,0 +1,35 @@
+# Spring Boot gRPC Sample
+
+This project is a copy one of the samples from the [gRPC Spring Boot Starter](https://github.com/yidongnan/grpc-spring-boot-starter/blob/master/examples/local-grpc-server/build.gradle). Build and run any way you like to run Spring Boot. E.g:
+
+```
+$ ./mvnw spring-boot:test-run
+...
+  .   ____          _            __ _ _
+ /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
+( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
+ \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
+  '  |____| .__|_| |_|_| |_\__, | / / / /
+ =========|_|==============|___/=/_/_/_/
+ :: Spring Boot ::                (v3.4.1)
+
+...
+2022-12-08T05:32:25.427-08:00  INFO 551632 --- [           main] g.s.a.GrpcServerFactoryAutoConfiguration : Detected grpc-netty: Creating NettyGrpcServerFactory
+2025-01-28T07:10:35.363Z  INFO 1218185 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port 44207 (http) with context path '/'
+2025-01-28T07:10:35.394Z  INFO 1218185 --- [           main] o.s.e.b.s.e.m.SpringBootApplicationMain  : Started SpringBootApplicationMain in 2.802 seconds (process running for 3.291)
+2025-01-28T07:10:35.749Z  INFO 1218050 --- [grpc-server] [           main] o.s.grpc.server.NettyGrpcServerFactory   : Registered gRPC service: Simple
+2025-01-28T07:10:35.749Z  INFO 1218050 --- [grpc-server] [           main] o.s.grpc.server.NettyGrpcServerFactory   : Registered gRPC service: grpc.reflection.v1.ServerReflection
+2025-01-28T07:10:35.749Z  INFO 1218050 --- [grpc-server] [           main] o.s.grpc.server.NettyGrpcServerFactory   : Registered gRPC service: grpc.health.v1.Health
+2025-01-28T07:10:35.835Z  INFO 1218050 --- [grpc-server] [           main] o.s.g.s.lifecycle.GrpcServerLifecycle    : gRPC Server started, listening on address: [/[0:0:0:0:0:0:0:0]:9090]
+2025-01-28T07:10:35.844Z  INFO 1218050 --- [grpc-server] [           main] o.s.grpc.sample.GrpcServerApplication    : Started GrpcServerApplication in 5.072 seconds (process running for 5.419)
+```
+
+The server starts by default on port 9090 and the auth server port is shown on start up (its random for now, until the testjars project has another release). Test with [gRPCurl](https://github.com/fullstorydev/grpcurl).  There is a B/S insecure channel that lets you authenticate by asserting in a header that you are a user:
+
+```
+$ TOKEN=`curl -v spring:secret@localhost:43737/oauth2/token -d grant_type=client_credentials | jq -r .access_token`
+$ grpcurl -H "Authorization: Bearer $TOKEN" -d '{"name":"Hi"}' -plaintext localhost:9090 Simple.SayHello
+{
+  "message": "Hello ==\u003e Hi"
+}
+```
--- a/samples/grpc-oauth2/build.gradle
+++ b/samples/grpc-oauth2/build.gradle
@@ -0,0 +1,60 @@
+plugins {
+	id 'java'
+	id 'org.springframework.boot' version '3.4.1'
+	id 'io.spring.dependency-management' version '1.1.6'
+	id 'org.graalvm.buildtools.native' version '0.10.3'
+	id 'com.google.protobuf' version '0.9.4'
+}
+
+group = 'com.example'
+version = '0.4.0-SNAPSHOT'
+
+java {
+	toolchain {
+		languageVersion = JavaLanguageVersion.of(17)
+	}
+}
+
+repositories {
+	mavenLocal()
+	mavenCentral()
+	maven { url 'https://repo.spring.io/milestone' }
+	maven { url 'https://repo.spring.io/snapshot' }
+}
+
+dependencyManagement {
+	imports {
+		mavenBom 'org.springframework.grpc:spring-grpc-dependencies:0.4.0-SNAPSHOT'
+	}
+}
+
+dependencies {
+	implementation 'org.springframework.grpc:spring-grpc-spring-boot-starter'
+	implementation 'org.springframework.boot:spring-boot-starter-security'
+	implementation 'io.grpc:grpc-services'
+	testImplementation 'org.springframework.boot:spring-boot-starter-test'
+	testImplementation 'org.springframework.grpc:spring-grpc-test'
+	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
+}
+
+tasks.named('test') {
+	useJUnitPlatform()
+}
+
+protobuf {
+    protoc {
+        artifact = "com.google.protobuf:protoc:${dependencyManagement.importedProperties['protobuf-java.version']}"
+    }
+    plugins {
+        grpc {
+            artifact = "io.grpc:protoc-gen-grpc-java:${dependencyManagement.importedProperties['grpc.version']}"
+        }
+    }
+    generateProtoTasks {
+        all()*.plugins {
+            grpc {
+				option 'jakarta_omit'
+			}
+		}
+    }
+}
--- a/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.jar
+++ b/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.jar
--- a/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.properties
+++ b/samples/grpc-oauth2/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
--- a/samples/grpc-oauth2/gradlew
+++ b/samples/grpc-oauth2/gradlew
@@ -0,0 +1,252 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s
+' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
--- a/samples/grpc-oauth2/gradlew.bat
+++ b/samples/grpc-oauth2/gradlew.bat
@@ -0,0 +1,94 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
--- a/samples/grpc-oauth2/pom.xml
+++ b/samples/grpc-oauth2/pom.xml
@@ -0,0 +1,245 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>org.springframework.boot</groupId>
+		<artifactId>spring-boot-starter-parent</artifactId>
+		<version>3.4.1</version>
+		<relativePath /> <!-- lookup parent from repository -->
+	</parent>
+	<groupId>org.springframework.grpc</groupId>
+	<artifactId>grpc-oauth2-sample</artifactId>
+	<version>0.4.0-SNAPSHOT</version>
+	<name>Spring gRPC Server Sample</name>
+	<description>Demo project for Spring gRPC</description>
+	<url />
+	<licenses>
+		<license />
+	</licenses>
+	<developers>
+		<developer />
+	</developers>
+	<scm>
+		<connection />
+		<developerConnection />
+		<tag />
+		<url />
+	</scm>
+	<properties>
+		<java.version>17</java.version>
+		<spring-javaformat-maven-plugin.version>0.0.39</spring-javaformat-maven-plugin.version>
+		<protobuf-java.version>3.25.5</protobuf-java.version>
+		<grpc.version>1.63.2</grpc.version>
+		<maven.version>3.9.4</maven.version>
+		<maven.resolver.version>1.9.18</maven.resolver.version>
+	</properties>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>org.springframework.grpc</groupId>
+				<artifactId>spring-grpc-dependencies</artifactId>
+				<version>0.4.0-SNAPSHOT</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+	<dependencies>
+		<dependency>
+			<groupId>org.springframework.grpc</groupId>
+			<artifactId>spring-grpc-spring-boot-starter</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>io.grpc</groupId>
+			<artifactId>grpc-services</artifactId>
+		</dependency>
+
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-oauth2-client</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.grpc</groupId>
+			<artifactId>spring-grpc-test</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.experimental.boot</groupId>
+			<artifactId>spring-boot-testjars</artifactId>
+			<version>0.0.2</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven</groupId>
+			<artifactId>maven-resolver-provider</artifactId>
+			<version>${maven.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-api</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-spi</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-util</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-impl</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-connector-basic</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-transport-file</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-transport-http</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.apache.maven.resolver</groupId>
+			<artifactId>maven-resolver-supplier</artifactId>
+			<version>${maven.resolver.version}</version>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
+
+	<build>
+		<extensions>
+			<extension>
+				<groupId>kr.motd.maven</groupId>
+				<artifactId>os-maven-plugin</artifactId>
+				<version>1.7.1</version>
+			</extension>
+		</extensions>
+		<plugins>
+			<plugin>
+				<groupId>org.graalvm.buildtools</groupId>
+				<artifactId>native-maven-plugin</artifactId>
+				<configuration>
+					<buildArgs>
+						<buildArg>--verbose</buildArg>
+					</buildArgs>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>org.springframework.boot</groupId>
+				<artifactId>spring-boot-maven-plugin</artifactId>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-deploy-plugin</artifactId>
+				<configuration>
+					<skip>true</skip>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>io.spring.javaformat</groupId>
+				<artifactId>spring-javaformat-maven-plugin</artifactId>
+				<version>${spring-javaformat-maven-plugin.version}</version>
+				<executions>
+					<execution>
+						<?m2e ignore?>
+						<phase>validate</phase>
+						<inherited>true</inherited>
+						<goals>
+							<goal>validate</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.xolstice.maven.plugins</groupId>
+				<artifactId>protobuf-maven-plugin</artifactId>
+				<version>0.6.1</version>
+				<configuration>
+					<protocArtifact>
+						com.google.protobuf:protoc:${protobuf-java.version}:exe:${os.detected.classifier}</protocArtifact>
+					<pluginId>grpc-java</pluginId>
+					<pluginArtifact>
+						io.grpc:protoc-gen-grpc-java:${grpc.version}:exe:${os.detected.classifier}</pluginArtifact>
+				</configuration>
+				<executions>
+					<execution>
+						<configuration>
+							<pluginParameter>
+								jakarta_omit,@generated=omit
+							</pluginParameter>
+						</configuration>
+						<goals>
+							<goal>compile</goal>
+							<goal>compile-custom</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+
+	<repositories>
+		<repository>
+			<id>spring-milestones</id>
+			<name>Spring Milestones</name>
+			<url>https://repo.spring.io/milestone</url>
+			<snapshots>
+				<enabled>false</enabled>
+			</snapshots>
+		</repository>
+		<repository>
+			<id>spring-snapshots</id>
+			<name>Spring Snapshots</name>
+			<url>https://repo.spring.io/snapshot</url>
+			<releases>
+				<enabled>false</enabled>
+			</releases>
+		</repository>
+	</repositories>
+	<pluginRepositories>
+		<pluginRepository>
+			<id>spring-milestones</id>
+			<name>Spring Milestones</name>
+			<url>https://repo.spring.io/milestone</url>
+			<snapshots>
+				<enabled>false</enabled>
+			</snapshots>
+		</pluginRepository>
+		<pluginRepository>
+			<id>spring-snapshots</id>
+			<name>Spring Snapshots</name>
+			<url>https://repo.spring.io/snapshot</url>
+			<releases>
+				<enabled>false</enabled>
+			</releases>
+		</pluginRepository>
+	</pluginRepositories>
+
+
+</project>
--- a/samples/grpc-oauth2/settings.gradle
+++ b/samples/grpc-oauth2/settings.gradle
@@ -0,0 +1,8 @@
+pluginManagement {
+	repositories {
+		maven { url 'https://repo.spring.io/milestone' }
+		maven { url 'https://repo.spring.io/snapshot' }
+		gradlePluginPortal()
+	}
+}
+rootProject.name = 'demo'
--- a/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java
+++ b/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java
@@ -0,0 +1,44 @@
+package org.springframework.grpc.sample;
+
+import static org.springframework.security.config.Customizer.withDefaults;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Import;
+import org.springframework.grpc.server.GlobalServerInterceptor;
+import org.springframework.grpc.server.security.AuthenticationProcessInterceptor;
+import org.springframework.grpc.server.security.GrpcSecurity;
+import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+
+import io.grpc.Metadata;
+
+@SpringBootApplication
+@EnableMethodSecurity
+@Import(AuthenticationConfiguration.class)
+public class GrpcServerApplication {
+
+	public static final Metadata.Key<String> USER_KEY = Metadata.Key.of("X-USER", Metadata.ASCII_STRING_MARSHALLER);
+
+	public static void main(String[] args) {
+		SpringApplication.run(GrpcServerApplication.class, args);
+	}
+
+	@Bean
+	@GlobalServerInterceptor
+	AuthenticationProcessInterceptor jwtSecurityFilterChain(GrpcSecurity grpc) throws Exception {
+		return grpc
+			.authorizeRequests(requests -> requests.methods("Simple/StreamHello")
+				.hasAuthority("SCOPE_profile")
+				.methods("Simple/SayHello")
+				.authenticated()
+				.methods("grpc.*/*")
+				.permitAll()
+				.allRequests()
+				.denyAll())
+			.oauth2ResourceServer((resourceServer) -> resourceServer.jwt(withDefaults()))
+			.build();
+	}
+
+}
--- a/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerService.java
+++ b/samples/grpc-oauth2/src/main/java/org/springframework/grpc/sample/GrpcServerService.java
@@ -0,0 +1,50 @@
+package org.springframework.grpc.sample;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.grpc.sample.proto.HelloReply;
+import org.springframework.grpc.sample.proto.HelloRequest;
+import org.springframework.grpc.sample.proto.SimpleGrpc;
+import org.springframework.stereotype.Service;
+
+import io.grpc.stub.StreamObserver;
+
+@Service
+public class GrpcServerService extends SimpleGrpc.SimpleImplBase {
+
+	private static Log log = LogFactory.getLog(GrpcServerService.class);
+
+	@Override
+	// @PreAuthorize("hasAuthority('ROLE_USER')")
+	public void sayHello(HelloRequest req, StreamObserver<HelloReply> responseObserver) {
+		log.info("Hello " + req.getName());
+		if (req.getName().startsWith("error")) {
+			throw new IllegalArgumentException("Bad name: " + req.getName());
+		}
+		HelloReply reply = HelloReply.newBuilder().setMessage("Hello ==> " + req.getName()).build();
+		responseObserver.onNext(reply);
+		responseObserver.onCompleted();
+	}
+
+	@Override
+	// @PreAuthorize("hasAuthority('ROLE_ADMIN')")
+	public void streamHello(HelloRequest req, StreamObserver<HelloReply> responseObserver) {
+		log.info("Hello " + req.getName());
+		int count = 0;
+		while (count < 10) {
+			HelloReply reply = HelloReply.newBuilder().setMessage("Hello(" + count + ") ==> " + req.getName()).build();
+			responseObserver.onNext(reply);
+			count++;
+			try {
+				Thread.sleep(1000L);
+			}
+			catch (InterruptedException e) {
+				Thread.currentThread().interrupt();
+				responseObserver.onError(e);
+				return;
+			}
+		}
+		responseObserver.onCompleted();
+	}
+
+}
--- a/samples/grpc-oauth2/src/main/proto/hello.proto
+++ b/samples/grpc-oauth2/src/main/proto/hello.proto
@@ -0,0 +1,23 @@
+syntax = "proto3";
+
+option java_multiple_files = true;
+option java_package = "org.springframework.grpc.sample.proto";
+option java_outer_classname = "HelloWorldProto";
+
+// The greeting service definition.
+service Simple {
+    // Sends a greeting
+    rpc SayHello (HelloRequest) returns (HelloReply) {
+    }
+    rpc StreamHello(HelloRequest) returns (stream HelloReply) {}
+}
+
+// The request message containing the user's name.
+message HelloRequest {
+    string name = 1;
+}
+
+// The response message containing the greetings
+message HelloReply {
+    string message = 1;
+}
--- a/samples/grpc-oauth2/src/main/resources/META-INF/native-image/org.springframework.samples/grpc-server-sample/native-image.properties
+++ b/samples/grpc-oauth2/src/main/resources/META-INF/native-image/org.springframework.samples/grpc-server-sample/native-image.properties
@@ -0,0 +1,2 @@
+# Ignored unless building in Nix (https://github.com/oracle/graal/issues/8639)
+Args = -ENIX_LDFLAGS -ENIX_CC_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu
--- a/samples/grpc-oauth2/src/main/resources/application.properties
+++ b/samples/grpc-oauth2/src/main/resources/application.properties
@@ -0,0 +1,8 @@
+spring.application.name=grpc-server
+logging.level.org.springframework.security=debug
+spring.security.oauth2.resourceserver.jwt.jwk-set-uri=${spring.security.oauth2.client.provider.spring.issuer-uri:http://localhost:9000}/oauth2/jwks
+spring.security.oauth2.client.registration.spring.client-id=spring
+spring.security.oauth2.client.registration.spring.client-secret=secret
+spring.security.oauth2.client.registration.spring.authorization-grant-type=client_credentials
+spring.security.oauth2.client.registration.spring.provider=local
+spring.security.oauth2.client.provider.local.token-uri=${spring.security.oauth2.client.provider.spring.issuer-uri:http://localhost:9000}/oauth2/token
--- a/samples/grpc-oauth2/src/test/java/org/springframework/grpc/sample/GrpcServerApplicationTests.java
+++ b/samples/grpc-oauth2/src/test/java/org/springframework/grpc/sample/GrpcServerApplicationTests.java
@@ -0,0 +1,159 @@
+package org.springframework.grpc.sample;
+
+import static org.junit.Assert.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.List;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+
+import org.awaitility.Awaitility;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.context.TestConfiguration;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.experimental.boot.server.exec.CommonsExecWebServerFactoryBean;
+import org.springframework.experimental.boot.server.exec.MavenClasspathEntry;
+import org.springframework.experimental.boot.test.context.EnableDynamicProperty;
+import org.springframework.experimental.boot.test.context.OAuth2ClientProviderIssuerUri;
+import org.springframework.grpc.client.ChannelBuilderOptions;
+import org.springframework.grpc.client.GrpcChannelFactory;
+import org.springframework.grpc.client.security.BearerTokenAuthenticationInterceptor;
+import org.springframework.grpc.sample.proto.HelloReply;
+import org.springframework.grpc.sample.proto.HelloRequest;
+import org.springframework.grpc.sample.proto.SimpleGrpc;
+import org.springframework.grpc.test.LocalGrpcPort;
+import org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequest;
+import org.springframework.security.oauth2.client.endpoint.RestClientClientCredentialsTokenResponseClient;
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+import org.springframework.test.annotation.DirtiesContext;
+
+import io.grpc.Status.Code;
+import io.grpc.StatusRuntimeException;
+import io.grpc.reflection.v1.ServerReflectionGrpc;
+import io.grpc.reflection.v1.ServerReflectionRequest;
+import io.grpc.reflection.v1.ServerReflectionResponse;
+import io.grpc.stub.StreamObserver;
+
+@SpringBootTest(properties = { "spring.grpc.server.port=0",
+		"spring.grpc.client.channels.stub.address=static://0.0.0.0:${local.grpc.port}" })
+public class GrpcServerApplicationTests {
+
+	public static void main(String[] args) {
+		SpringApplication.from(GrpcServerApplication::main).with(ExtraConfiguration.class).run(args);
+	}
+
+	@Autowired
+	@Qualifier("stub")
+	private SimpleGrpc.SimpleBlockingStub stub;
+
+	@Autowired
+	@Qualifier("reflect")
+	private ServerReflectionGrpc.ServerReflectionStub reflect;
+
+	@Autowired
+	@Qualifier("basic")
+	private SimpleGrpc.SimpleBlockingStub basic;
+
+	@Test
+	@DirtiesContext
+	void contextLoads() {
+	}
+
+	@Test
+	@DirtiesContext
+	void unauthenticated() {
+		StatusRuntimeException exception = assertThrows(StatusRuntimeException.class,
+				() -> stub.sayHello(HelloRequest.newBuilder().setName("Alien").build()));
+		assertEquals(Code.UNAUTHENTICATED, exception.getStatus().getCode());
+	}
+
+	@Test
+	@DirtiesContext
+	void anonymous() throws Exception {
+		AtomicReference<ServerReflectionResponse> response = new AtomicReference<>();
+		AtomicBoolean error = new AtomicBoolean();
+		StreamObserver<ServerReflectionResponse> responses = new StreamObserver<ServerReflectionResponse>() {
+			@Override
+			public void onNext(ServerReflectionResponse value) {
+				response.set(value);
+			}
+
+			@Override
+			public void onError(Throwable t) {
+				error.set(true);
+			}
+
+			@Override
+			public void onCompleted() {
+			}
+		};
+		StreamObserver<ServerReflectionRequest> request = reflect.serverReflectionInfo(responses);
+		request.onNext(ServerReflectionRequest.newBuilder().setListServices("").build());
+		request.onCompleted();
+		Awaitility.await().until(() -> response.get() != null || error.get());
+	}
+
+	@Test
+	@DirtiesContext
+	void unauthauthorized() {
+		// The token has no scopes and scope=profile is required
+		StatusRuntimeException exception = assertThrows(StatusRuntimeException.class,
+				() -> basic.streamHello(HelloRequest.newBuilder().setName("Alien").build()).next());
+		assertEquals(Code.PERMISSION_DENIED, exception.getStatus().getCode());
+	}
+
+	@Test
+	@DirtiesContext
+	void authenticated() {
+		// The token has no scopes but none are required
+		HelloReply response = basic.sayHello(HelloRequest.newBuilder().setName("Alien").build());
+		assertEquals("Hello ==> Alien", response.getMessage());
+	}
+
+	@TestConfiguration(proxyBeanMethods = false)
+	@EnableDynamicProperty
+	static class ExtraConfiguration {
+
+		@Bean
+		@OAuth2ClientProviderIssuerUri
+		static CommonsExecWebServerFactoryBean authServer() {
+			return CommonsExecWebServerFactoryBean.builder()
+				.defaultSpringBootApplicationMain()
+				.classpath(classpath -> classpath
+					.entries(MavenClasspathEntry.springBootStarter("oauth2-authorization-server")));
+		}
+
+		@Bean
+		@Lazy
+		SimpleGrpc.SimpleBlockingStub basic(GrpcChannelFactory channels, @LocalGrpcPort int port,
+				ClientRegistrationRepository registry) {
+			RestClientClientCredentialsTokenResponseClient creds = new RestClientClientCredentialsTokenResponseClient();
+			ClientRegistration reg = registry.findByRegistrationId("spring");
+			String token = creds.getTokenResponse(new OAuth2ClientCredentialsGrantRequest(reg))
+				.getAccessToken()
+				.getTokenValue();
+			return SimpleGrpc.newBlockingStub(channels.createChannel("stub", ChannelBuilderOptions.defaults()
+				.withInterceptors(List.of(new BearerTokenAuthenticationInterceptor(token)))));
+		}
+
+		@Bean
+		@Lazy
+		SimpleGrpc.SimpleBlockingStub stub(GrpcChannelFactory channels, @LocalGrpcPort int port) {
+			return SimpleGrpc.newBlockingStub(channels.createChannel("stub"));
+		}
+
+		@Bean
+		@Lazy
+		ServerReflectionGrpc.ServerReflectionStub reflect(GrpcChannelFactory channels, @LocalGrpcPort int port) {
+			return ServerReflectionGrpc.newStub(channels.createChannel("stub"));
+		}
+
+	}
+
+}
--- a/samples/grpc-oauth2/src/test/resources/testjars/authServer/application.yml
+++ b/samples/grpc-oauth2/src/test/resources/testjars/authServer/application.yml
@@ -0,0 +1,18 @@
+logging.level.org.springframework.security: TRACE
+spring:
+  security:
+    oauth2:
+      authorizationserver:
+        client:
+          oidc-client:
+            registration:
+              client-id: "spring"
+              client-secret: "{noop}secret"
+              client-authentication-methods:
+                - "client_secret_basic"
+              authorization-grant-types:
+                - "client_credentials"
+                - "refresh_token"
+              scopes:
+                - "openid"
+                - "profile"
--- a/samples/grpc-secure/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java
+++ b/samples/grpc-secure/src/main/java/org/springframework/grpc/sample/GrpcServerApplication.java
@@ -38,11 +38,14 @@ public class GrpcServerApplication {
 	@GlobalServerInterceptor
 	public ServerInterceptor securityInterceptor(GrpcSecurity security) throws Exception {
 		return security
-			.authorizeRequests(requests -> requests
-				.methods("Simple/StreamHello").hasAuthority("ROLE_ADMIN")
-				.methods("Simple/SayHello").hasAuthority("ROLE_USER")
-				.methods("grpc.*/*").permitAll()
-				.allRequests().denyAll())
+			.authorizeRequests(requests -> requests.methods("Simple/StreamHello")
+				.hasAuthority("ROLE_ADMIN")
+				.methods("Simple/SayHello")
+				.hasAuthority("ROLE_USER")
+				.methods("grpc.*/*")
+				.permitAll()
+				.allRequests()
+				.denyAll())
 			.httpBasic(withDefaults())
 			.preauth(withDefaults())
 			.build();
--- a/samples/grpc-tomcat-secure/src/main/java/org/springframework/grpc/sample/GrpcServerService.java
+++ b/samples/grpc-tomcat-secure/src/main/java/org/springframework/grpc/sample/GrpcServerService.java
@@ -5,7 +5,6 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.grpc.sample.proto.HelloReply;
 import org.springframework.grpc.sample.proto.HelloRequest;
 import org.springframework.grpc.sample.proto.SimpleGrpc;
-import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Service;

--- a/samples/pom.xml
+++ b/samples/pom.xml
@@ -18,6 +18,7 @@
 	<modules>
 		<module>grpc-server</module>
 		<module>grpc-secure</module>
+		<module>grpc-oauth2</module>
 		<module>grpc-reactive</module>
 		<module>grpc-server-netty-shaded</module>
 		<module>grpc-tomcat</module>
--- a/spring-grpc-core/pom.xml
+++ b/spring-grpc-core/pom.xml
@@ -32,6 +32,16 @@
 			<artifactId>spring-security-web</artifactId>
 			<optional>true</optional>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-resource-server</artifactId>
+			<optional>true</optional>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-jose</artifactId>
+			<optional>true</optional>
+		</dependency>
 		<dependency>
 			<groupId>org.springframework.security</groupId>
 			<artifactId>spring-security-config</artifactId>
--- a/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/BearerTokenAuthenticationExtractor.java
+++ b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/BearerTokenAuthenticationExtractor.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2024-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.grpc.server.security;
+
+import java.util.Locale;
+
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken;
+
+import io.grpc.Attributes;
+import io.grpc.Metadata;
+
+/**
+ * Extracts the HTTP Basic authentication credentials from the gRPC request headers. If
+ * the 'Authorization' header is present and starts with 'Basic ', the username and
+ * password are extracted from the Base64-encoded header value and returned as a
+ * {@link UsernamePasswordAuthenticationToken}. If the header is not present or does not
+ * start with 'Basic ', this method returns null.
+ *
+ * @author Dave Syer
+ */
+public class BearerTokenAuthenticationExtractor implements GrpcAuthenticationExtractor {
+
+	@Override
+	public Authentication extract(Metadata headers, Attributes attributes) {
+		String auth = headers.get(GrpcSecurity.AUTHORIZATION_KEY);
+		if (auth == null) {
+			return null;
+		}
+		if (!auth.toLowerCase(Locale.ROOT).startsWith("bearer ")) {
+			return null;
+		}
+		auth = auth.substring("bearer ".length());
+		return new BearerTokenAuthenticationToken(auth);
+	}
+
+}
--- a/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/GrpcSecurity.java
+++ b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/GrpcSecurity.java
@@ -146,6 +146,12 @@ public final class GrpcSecurity
 		return this;
 	}

+	public GrpcSecurity oauth2ResourceServer(Customizer<OAuth2ResourceServerConfigurer> customizer) throws Exception {
+		customizer.customize(getOrApply(new OAuth2ResourceServerConfigurer(getContext())));
+		authenticationExtractor(new BearerTokenAuthenticationExtractor());
+		return this;
+	}
+
 	@SuppressWarnings({ "unchecked", "removal" })
 	private <C extends SecurityConfigurerAdapter<AuthenticationProcessInterceptor, GrpcSecurity>> C getOrApply(
 			C configurer) throws Exception {
--- a/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/OAuth2ResourceServerConfigurer.java
+++ b/spring-grpc-core/src/main/java/org/springframework/grpc/server/security/OAuth2ResourceServerConfigurer.java
@@ -0,0 +1,257 @@
+/*
+ * Copyright 2024-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.grpc.server.security;
+
+import java.util.function.Supplier;
+
+import org.springframework.context.ApplicationContext;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.SecurityConfigurerAdapter;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider;
+import org.springframework.security.oauth2.server.resource.authentication.OpaqueTokenAuthenticationProvider;
+import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenAuthenticationConverter;
+import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
+import org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector;
+import org.springframework.util.Assert;
+
+public class OAuth2ResourceServerConfigurer
+		extends SecurityConfigurerAdapter<AuthenticationProcessInterceptor, GrpcSecurity> {
+
+	private final ApplicationContext context;
+
+	private JwtConfigurer jwtConfigurer;
+
+	private OpaqueTokenConfigurer opaqueTokenConfigurer;
+
+	public OAuth2ResourceServerConfigurer(ApplicationContext context) {
+		this.context = context;
+	}
+
+	public OAuth2ResourceServerConfigurer jwt(Customizer<JwtConfigurer> jwtCustomizer) {
+		if (this.jwtConfigurer == null) {
+			this.jwtConfigurer = new JwtConfigurer(this.context);
+		}
+		jwtCustomizer.customize(this.jwtConfigurer);
+		return this;
+	}
+
+	public OAuth2ResourceServerConfigurer opaqueToken(Customizer<OpaqueTokenConfigurer> opaqueTokenCustomizer) {
+		if (this.opaqueTokenConfigurer == null) {
+			this.opaqueTokenConfigurer = new OpaqueTokenConfigurer(this.context);
+		}
+		opaqueTokenCustomizer.customize(this.opaqueTokenConfigurer);
+		return this;
+	}
+
+	@Override
+	public void init(GrpcSecurity grpc) {
+		AuthenticationProvider authenticationProvider = getAuthenticationProvider();
+		if (authenticationProvider != null) {
+			grpc.authenticationProvider(authenticationProvider);
+		}
+	}
+
+	AuthenticationProvider getAuthenticationProvider() {
+		if (this.jwtConfigurer != null) {
+			return this.jwtConfigurer.getAuthenticationProvider();
+		}
+		if (this.opaqueTokenConfigurer != null) {
+			return this.opaqueTokenConfigurer.getAuthenticationProvider();
+		}
+		return null;
+	}
+
+	public class JwtConfigurer {
+
+		private final ApplicationContext context;
+
+		private AuthenticationManager authenticationManager;
+
+		private JwtDecoder decoder;
+
+		private Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter;
+
+		JwtConfigurer(ApplicationContext context) {
+			this.context = context;
+		}
+
+		public JwtConfigurer authenticationManager(AuthenticationManager authenticationManager) {
+			Assert.notNull(authenticationManager, "authenticationManager cannot be null");
+			this.authenticationManager = authenticationManager;
+			return this;
+		}
+
+		public JwtConfigurer decoder(JwtDecoder decoder) {
+			this.decoder = decoder;
+			return this;
+		}
+
+		public JwtConfigurer jwkSetUri(String uri) {
+			this.decoder = NimbusJwtDecoder.withJwkSetUri(uri).build();
+			return this;
+		}
+
+		public JwtConfigurer jwtAuthenticationConverter(
+				Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter) {
+			this.jwtAuthenticationConverter = jwtAuthenticationConverter;
+			return this;
+		}
+
+		Converter<Jwt, ? extends AbstractAuthenticationToken> getJwtAuthenticationConverter() {
+			if (this.jwtAuthenticationConverter == null) {
+				if (this.context.getBeanNamesForType(JwtAuthenticationConverter.class).length > 0) {
+					this.jwtAuthenticationConverter = this.context.getBean(JwtAuthenticationConverter.class);
+				}
+				else {
+					this.jwtAuthenticationConverter = new JwtAuthenticationConverter();
+				}
+			}
+			return this.jwtAuthenticationConverter;
+		}
+
+		JwtDecoder getJwtDecoder() {
+			if (this.decoder == null) {
+				return this.context.getBean(JwtDecoder.class);
+			}
+			return this.decoder;
+		}
+
+		AuthenticationProvider getAuthenticationProvider() {
+			if (this.authenticationManager != null) {
+				return null;
+			}
+			JwtDecoder decoder = getJwtDecoder();
+			Converter<Jwt, ? extends AbstractAuthenticationToken> jwtAuthenticationConverter = getJwtAuthenticationConverter();
+			JwtAuthenticationProvider provider = new JwtAuthenticationProvider(decoder);
+			provider.setJwtAuthenticationConverter(jwtAuthenticationConverter);
+			return postProcess(provider);
+		}
+
+		AuthenticationManager getAuthenticationManager(GrpcSecurity grpc) {
+			if (this.authenticationManager != null) {
+				return this.authenticationManager;
+			}
+			return grpc.getSharedObject(AuthenticationManager.class);
+		}
+
+	}
+
+	public class OpaqueTokenConfigurer {
+
+		private final ApplicationContext context;
+
+		private AuthenticationManager authenticationManager;
+
+		private String introspectionUri;
+
+		private String clientId;
+
+		private String clientSecret;
+
+		private Supplier<OpaqueTokenIntrospector> introspector;
+
+		private OpaqueTokenAuthenticationConverter authenticationConverter;
+
+		OpaqueTokenConfigurer(ApplicationContext context) {
+			this.context = context;
+		}
+
+		public OpaqueTokenConfigurer authenticationManager(AuthenticationManager authenticationManager) {
+			Assert.notNull(authenticationManager, "authenticationManager cannot be null");
+			this.authenticationManager = authenticationManager;
+			return this;
+		}
+
+		public OpaqueTokenConfigurer introspectionUri(String introspectionUri) {
+			Assert.notNull(introspectionUri, "introspectionUri cannot be null");
+			this.introspectionUri = introspectionUri;
+			this.introspector = () -> new SpringOpaqueTokenIntrospector(this.introspectionUri, this.clientId,
+					this.clientSecret);
+			return this;
+		}
+
+		public OpaqueTokenConfigurer introspectionClientCredentials(String clientId, String clientSecret) {
+			Assert.notNull(clientId, "clientId cannot be null");
+			Assert.notNull(clientSecret, "clientSecret cannot be null");
+			this.clientId = clientId;
+			this.clientSecret = clientSecret;
+			this.introspector = () -> new SpringOpaqueTokenIntrospector(this.introspectionUri, this.clientId,
+					this.clientSecret);
+			return this;
+		}
+
+		public OpaqueTokenConfigurer introspector(OpaqueTokenIntrospector introspector) {
+			Assert.notNull(introspector, "introspector cannot be null");
+			this.introspector = () -> introspector;
+			return this;
+		}
+
+		public OpaqueTokenConfigurer authenticationConverter(
+				OpaqueTokenAuthenticationConverter authenticationConverter) {
+			Assert.notNull(authenticationConverter, "authenticationConverter cannot be null");
+			this.authenticationConverter = authenticationConverter;
+			return this;
+		}
+
+		OpaqueTokenIntrospector getIntrospector() {
+			if (this.introspector != null) {
+				return this.introspector.get();
+			}
+			return this.context.getBean(OpaqueTokenIntrospector.class);
+		}
+
+		OpaqueTokenAuthenticationConverter getAuthenticationConverter() {
+			if (this.authenticationConverter != null) {
+				return this.authenticationConverter;
+			}
+			if (this.context.getBeanNamesForType(OpaqueTokenAuthenticationConverter.class).length > 0) {
+				return this.context.getBean(OpaqueTokenAuthenticationConverter.class);
+			}
+			return null;
+		}
+
+		AuthenticationProvider getAuthenticationProvider() {
+			if (this.authenticationManager != null) {
+				return null;
+			}
+			OpaqueTokenIntrospector introspector = getIntrospector();
+			OpaqueTokenAuthenticationProvider opaqueTokenAuthenticationProvider = new OpaqueTokenAuthenticationProvider(
+					introspector);
+			OpaqueTokenAuthenticationConverter authenticationConverter = getAuthenticationConverter();
+			if (authenticationConverter != null) {
+				opaqueTokenAuthenticationProvider.setAuthenticationConverter(authenticationConverter);
+			}
+			return opaqueTokenAuthenticationProvider;
+		}
+
+		AuthenticationManager getAuthenticationManager(GrpcSecurity http) {
+			if (this.authenticationManager != null) {
+				return this.authenticationManager;
+			}
+			return http.getSharedObject(AuthenticationManager.class);
+		}
+
+	}
+
+}
--- a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/client.adoc
+++ b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/client.adoc
@@ -253,3 +253,28 @@ Channel basic(GrpcChannelFactory channels) {

 Usage of the bearer token interceptor is similar.
 You can look at the implementation of those interceptors to see how to create your own for custom headers.
+
+=== OAuth2 Clients
+
+Spring gRPC provides an autoconfigured OAuth2 client that can be used to provide authentication to your gRPC clients.
+It works the same as in any Spring Boot application, in that if you configure properties in `spring.security.oauth2.authorizationserver.client.*` you will be able to inject an `ClientRegistrationRepository` and use it to create an `OAuth2AuthorizedClient` for a given client registration.
+Here's an example showing how to plug the client registration into a `BearerTokenAuthenticationInterceptor` in the gRPC client:
+
+[source,java]
+----
+@Bean
+@Lazy
+SimpleGrpc.SimpleBlockingStub basic(GrpcChannelFactory channels, ClientRegistrationRepository registry) {
+	ClientRegistration reg = registry.findByRegistrationId("spring");
+	return SimpleGrpc.newBlockingStub(channels.createChannel("0.0.0.0:9090", ChannelBuilderOptions.defaults()
+		.withInterceptors(List.of(new BearerTokenAuthenticationInterceptor(() -> token(reg))))));
+}
+
+private String token(ClientRegistration reg) {
+	RestClientClientCredentialsTokenResponseClient creds = new RestClientClientCredentialsTokenResponseClient();
+	String token = creds.getTokenResponse(new OAuth2ClientCredentialsGrantRequest(reg))
+		.getAccessToken()
+		.getTokenValue();
+	return token;
+}
+----
--- a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc
+++ b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc
@@ -185,6 +185,60 @@ Here we configure a bundle named "ssltest" that uses a JKS keystore, similar to
 It is then applied to the gRPC server using the `spring.grpc.server.ssl.bundle` property.
 To use self-signed certificates, for testing purposes only, you also need to set `spring.grpc.server.ssl.secure=false`.

+=== Declarative Security with Spring Security
+
+If you want to enhance the security of your gRPC server, you can use Spring Security by employing similar mechanisms to those used for regular HTTP security.
+If Spring Security is on the classpath, some autoconfiguration will be automatically added to your project.
+By default, just https://docs.spring.io/spring-boot/reference/web/spring-security.html[like in a servlet application], you will get a `UserDetailsService` from Spring Boot and an `AuthenticationManager` that will authenticate requests using HTTP Basic authentication.
+Basic authentication is enabled by default, as well as "preauthentication" via mTLS.
+Preauthentication works by extracting a user details object from the client's TLS certificate, matching the principal name with the user in the `UserDetailsService` (just like in a normal web application).
+You can then use `@Preauthorize` on your `BindableService` beans to enforce authorization rules with roles (more precisely authorities in Spring Security terminology).
+
+You can change the defaults and add your own rules by configuring beans of type `UserDetailsService` and/or `AuthenticationServerInterceptor`.
+In this way you can move the authorization rules to a central place, and you can also add your own authentication mechanisms.
+The `AuthenticationServerInterceptor` can be created from a Spring Security configurer of type `GrpcSecurity`.
+Its usage will be familiar to anyone who has used Spring Security before.
+Here's an example:
+
+[source,java]
+----
+@Bean
+@GlobalServerInterceptor
+AuthenticationProcessInterceptor jwtSecurityFilterChain(GrpcSecurity grpc) throws Exception {
+	return grpc
+			.authorizeRequests(requests -> requests
+					.methods("Simple/StreamHello").hasAuthority("ROLE_ADMIN")
+					.methods("Simple/SayHello").hasAuthority("ROLE_USER")
+					.methods("grpc.*/*").permitAll()
+					.allRequests().denyAll())
+			.httpBasic(withDefaults())
+			.preauth(withDefaults())
+			.build();
+}
+----
+
+Here we configure a filter that allows access to one method only to admin users, and another to users with the "USER" role;
+access to all gRPC services (e.g. reflection and health indicators) is allowed to all; and all other requests are denied.
+We also enable HTTP Basic authentication and preauthentication (mTLS) (`withDefaults()` is a static import from the `Customizer` in Spring Security).
+
+=== OAuth2 Resource Server
+
+Similar to the way Spring Boot works https://docs.spring.io/spring-boot/reference/web/spring-security.html#web.security.oauth2.server[with normal web applications], if you have the `spring-security-oauth2-resource-server` dependency on the classpath, Spring gRPC will be able to automatically configure an OAuth2 resource server.
+There are 2 choices for the token types, just the same as in Spring Boot, and they are configured with the same application properties and optional custom beans.
+
+For JWT you need to set up either the JWK Set or OIDC Issuer URI.
+The JWK Set URI is set via `spring.security.oauth2.resourceserver.jwt.jwk-set-uri` (it's an endpoint in the authorization server).
+You also need to have the `spring-security-oauth2-jose` dependency on the classpath to handle the JWT decoding.
+
+For opaque tokens, it works exactly the same as with a regular web application, with the same application properties. E.g.
+
+[source,properties]
+----
+spring.security.oauth2.resourceserver.opaquetoken.introspection-uri=https://example.com/check-token
+spring.security.oauth2.resourceserver.opaquetoken.client-id=my-client-id
+spring.security.oauth2.resourceserver.opaquetoken.client-secret=my-client-secret
+----
+
 === Servlet

 The servlet-based server supports any security configuration that the servlet container supports, including Spring Security.
--- a/spring-grpc-spring-boot-autoconfigure/pom.xml
+++ b/spring-grpc-spring-boot-autoconfigure/pom.xml
@@ -110,6 +110,21 @@
 			<artifactId>spring-security-config</artifactId>
 			<optional>true</optional>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-client</artifactId>
+			<optional>true</optional>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-resource-server</artifactId>
+			<optional>true</optional>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework.security</groupId>
+			<artifactId>spring-security-oauth2-jose</artifactId>
+			<optional>true</optional>
+		</dependency>
 		<dependency>
 			<groupId>org.springframework.security</groupId>
 			<artifactId>spring-security-web</artifactId>
--- a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/GrpcServerFactoryAutoConfiguration.java
+++ b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/GrpcServerFactoryAutoConfiguration.java
@@ -33,14 +33,12 @@ import org.springframework.boot.web.servlet.ServletRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Conditional;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.ConfigurationCondition.ConfigurationPhase;
 import org.springframework.context.annotation.Import;
 import org.springframework.core.Ordered;
 import org.springframework.grpc.server.service.GrpcServiceDiscoverer;
 import org.springframework.util.unit.DataSize;

 import io.grpc.BindableService;
-import io.grpc.ServerServiceDefinition;
 import io.grpc.servlet.jakarta.GrpcServlet;
 import io.grpc.servlet.jakarta.ServletServerBuilder;

--- a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ClientAutoConfiguration.java
+++ b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ClientAutoConfiguration.java
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2024-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.grpc.autoconfigure.server.security;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.security.oauth2.client.ClientsConfiguredCondition;
+import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties;
+import org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Conditional;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
+import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
+import org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository;
+
+// Copied from Spring Boot (https://github.com/spring-projects/spring-boot/issues/40997, ]
+// https://github.com/spring-projects/spring-boot/issues/15877)
+@AutoConfiguration(
+		after = org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration.class)
+@Configuration(proxyBeanMethods = false)
+@Conditional(ClientsConfiguredCondition.class)
+@EnableConfigurationProperties(OAuth2ClientProperties.class)
+public class OAuth2ClientAutoConfiguration {
+
+	@Bean
+	@ConditionalOnMissingBean(ClientRegistrationRepository.class)
+	InMemoryClientRegistrationRepository clientRegistrationRepository(OAuth2ClientProperties properties) {
+		List<ClientRegistration> registrations = new ArrayList<>(
+				new OAuth2ClientPropertiesMapper(properties).asClientRegistrations().values());
+		return new InMemoryClientRegistrationRepository(registrations);
+	}
+
+}
--- a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ResourceServerAutoConfiguration.java
+++ b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/OAuth2ResourceServerAutoConfiguration.java
@@ -0,0 +1,303 @@
+/*
+ * Copyright 2024-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.grpc.autoconfigure.server.security;
+
+import static org.springframework.security.config.Customizer.withDefaults;
+
+import java.security.KeyFactory;
+import java.security.interfaces.RSAPublicKey;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.AnyNestedCondition;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.autoconfigure.security.oauth2.resource.IssuerUriCondition;
+import org.springframework.boot.autoconfigure.security.oauth2.resource.KeyValueCondition;
+import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
+import org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.JwkSetUriJwtDecoderBuilderCustomizer;
+import org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.context.properties.PropertyMapper;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Conditional;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+import org.springframework.grpc.server.GlobalServerInterceptor;
+import org.springframework.grpc.server.security.AuthenticationProcessInterceptor;
+import org.springframework.grpc.server.security.GrpcSecurity;
+import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
+import org.springframework.security.oauth2.core.OAuth2TokenValidator;
+import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.jwt.JwtClaimNames;
+import org.springframework.security.oauth2.jwt.JwtClaimValidator;
+import org.springframework.security.oauth2.jwt.JwtDecoder;
+import org.springframework.security.oauth2.jwt.JwtValidators;
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder;
+import org.springframework.security.oauth2.jwt.SupplierJwtDecoder;
+import org.springframework.security.oauth2.server.resource.authentication.BearerTokenAuthenticationToken;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
+import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
+import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
+import org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector;
+import org.springframework.util.CollectionUtils;
+
+// All copied from Spring Boot (https://github.com/spring-projects/spring-boot/issues/43978), except the
+// 2 @Beans of type AuthenticationProcessInterceptor
+@AutoConfiguration(before = { GrpcSecurityAutoConfiguration.class, UserDetailsServiceAutoConfiguration.class },
+		after = org.springframework.boot.autoconfigure.security.oauth2.resource.servlet.OAuth2ResourceServerAutoConfiguration.class)
+@EnableConfigurationProperties(OAuth2ResourceServerProperties.class)
+@ConditionalOnClass(BearerTokenAuthenticationToken.class)
+@Import({ Oauth2ResourceServerConfiguration.JwtConfiguration.class,
+		Oauth2ResourceServerConfiguration.OpaqueTokenConfiguration.class })
+class OAuth2ResourceServerAutoConfiguration {
+
+}
+
+@Configuration(proxyBeanMethods = false)
+class Oauth2ResourceServerConfiguration {
+
+	@Configuration(proxyBeanMethods = false)
+	@ConditionalOnClass(JwtDecoder.class)
+	@Import({ OAuth2ResourceServerJwtConfiguration.JwtConverterConfiguration.class,
+			OAuth2ResourceServerJwtConfiguration.JwtDecoderConfiguration.class,
+			OAuth2ResourceServerJwtConfiguration.OAuth2SecurityFilterChainConfiguration.class })
+	static class JwtConfiguration {
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	@Import({ OAuth2ResourceServerOpaqueTokenConfiguration.OpaqueTokenIntrospectionClientConfiguration.class,
+			OAuth2ResourceServerOpaqueTokenConfiguration.OAuth2SecurityFilterChainConfiguration.class })
+	static class OpaqueTokenConfiguration {
+
+	}
+
+}
+
+@Configuration(proxyBeanMethods = false)
+class OAuth2ResourceServerOpaqueTokenConfiguration {
+
+	@Configuration(proxyBeanMethods = false)
+	@ConditionalOnMissingBean(OpaqueTokenIntrospector.class)
+	static class OpaqueTokenIntrospectionClientConfiguration {
+
+		@Bean
+		@ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.opaquetoken.introspection-uri")
+		SpringOpaqueTokenIntrospector opaqueTokenIntrospector(OAuth2ResourceServerProperties properties) {
+			OAuth2ResourceServerProperties.Opaquetoken opaqueToken = properties.getOpaquetoken();
+			return new SpringOpaqueTokenIntrospector(opaqueToken.getIntrospectionUri(), opaqueToken.getClientId(),
+					opaqueToken.getClientSecret());
+		}
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	@ConditionalOnMissingBean(AuthenticationProcessInterceptor.class)
+	static class OAuth2SecurityFilterChainConfiguration {
+
+		@Bean
+		@ConditionalOnBean(OpaqueTokenIntrospector.class)
+		@GlobalServerInterceptor
+		AuthenticationProcessInterceptor opaqueTokenSecurityFilterChain(GrpcSecurity http) throws Exception {
+			http.authorizeRequests((requests) -> requests.allRequests().authenticated());
+			http.oauth2ResourceServer((resourceServer) -> resourceServer.opaqueToken(withDefaults()));
+			return http.build();
+		}
+
+	}
+
+}
+
+@Configuration(proxyBeanMethods = false)
+class OAuth2ResourceServerJwtConfiguration {
+
+	@Configuration(proxyBeanMethods = false)
+	@ConditionalOnMissingBean(JwtDecoder.class)
+	static class JwtDecoderConfiguration {
+
+		private final OAuth2ResourceServerProperties.Jwt properties;
+
+		private final List<OAuth2TokenValidator<Jwt>> additionalValidators;
+
+		JwtDecoderConfiguration(OAuth2ResourceServerProperties properties,
+				ObjectProvider<OAuth2TokenValidator<Jwt>> additionalValidators) {
+			this.properties = properties.getJwt();
+			this.additionalValidators = additionalValidators.orderedStream().toList();
+		}
+
+		@Bean
+		@ConditionalOnProperty(name = "spring.security.oauth2.resourceserver.jwt.jwk-set-uri")
+		JwtDecoder jwtDecoderByJwkKeySetUri(ObjectProvider<JwkSetUriJwtDecoderBuilderCustomizer> customizers) {
+			JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withJwkSetUri(this.properties.getJwkSetUri())
+				.jwsAlgorithms(this::jwsAlgorithms);
+			customizers.orderedStream().forEach((customizer) -> customizer.customize(builder));
+			NimbusJwtDecoder nimbusJwtDecoder = builder.build();
+			String issuerUri = this.properties.getIssuerUri();
+			OAuth2TokenValidator<Jwt> defaultValidator = (issuerUri != null)
+					? JwtValidators.createDefaultWithIssuer(issuerUri) : JwtValidators.createDefault();
+			nimbusJwtDecoder.setJwtValidator(getValidators(defaultValidator));
+			return nimbusJwtDecoder;
+		}
+
+		private void jwsAlgorithms(Set<SignatureAlgorithm> signatureAlgorithms) {
+			for (String algorithm : this.properties.getJwsAlgorithms()) {
+				signatureAlgorithms.add(SignatureAlgorithm.from(algorithm));
+			}
+		}
+
+		private OAuth2TokenValidator<Jwt> getValidators(OAuth2TokenValidator<Jwt> defaultValidator) {
+			List<String> audiences = this.properties.getAudiences();
+			if (CollectionUtils.isEmpty(audiences) && this.additionalValidators.isEmpty()) {
+				return defaultValidator;
+			}
+			List<OAuth2TokenValidator<Jwt>> validators = new ArrayList<>();
+			validators.add(defaultValidator);
+			if (!CollectionUtils.isEmpty(audiences)) {
+				validators.add(audValidator(audiences));
+			}
+			validators.addAll(this.additionalValidators);
+			return new DelegatingOAuth2TokenValidator<>(validators);
+		}
+
+		private JwtClaimValidator<List<String>> audValidator(List<String> audiences) {
+			return new JwtClaimValidator<>(JwtClaimNames.AUD, (aud) -> nullSafeDisjoint(aud, audiences));
+		}
+
+		private boolean nullSafeDisjoint(List<String> c1, List<String> c2) {
+			return c1 != null && !Collections.disjoint(c1, c2);
+		}
+
+		@Bean
+		@Conditional(KeyValueCondition.class)
+		JwtDecoder jwtDecoderByPublicKeyValue() throws Exception {
+			RSAPublicKey publicKey = (RSAPublicKey) KeyFactory.getInstance("RSA")
+				.generatePublic(new X509EncodedKeySpec(getKeySpec(this.properties.readPublicKey())));
+			NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withPublicKey(publicKey)
+				.signatureAlgorithm(SignatureAlgorithm.from(exactlyOneAlgorithm()))
+				.build();
+			jwtDecoder.setJwtValidator(getValidators(JwtValidators.createDefault()));
+			return jwtDecoder;
+		}
+
+		private byte[] getKeySpec(String keyValue) {
+			keyValue = keyValue.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "");
+			return Base64.getMimeDecoder().decode(keyValue);
+		}
+
+		private String exactlyOneAlgorithm() {
+			List<String> algorithms = this.properties.getJwsAlgorithms();
+			int count = (algorithms != null) ? algorithms.size() : 0;
+			if (count != 1) {
+				throw new IllegalStateException(
+						"Creating a JWT decoder using a public key requires exactly one JWS algorithm but " + count
+								+ " were configured");
+			}
+			return algorithms.get(0);
+		}
+
+		@Bean
+		@Conditional(IssuerUriCondition.class)
+		SupplierJwtDecoder jwtDecoderByIssuerUri(ObjectProvider<JwkSetUriJwtDecoderBuilderCustomizer> customizers) {
+			return new SupplierJwtDecoder(() -> {
+				String issuerUri = this.properties.getIssuerUri();
+				JwkSetUriJwtDecoderBuilder builder = NimbusJwtDecoder.withIssuerLocation(issuerUri);
+				customizers.orderedStream().forEach((customizer) -> customizer.customize(builder));
+				NimbusJwtDecoder jwtDecoder = builder.build();
+				jwtDecoder.setJwtValidator(getValidators(JwtValidators.createDefaultWithIssuer(issuerUri)));
+				return jwtDecoder;
+			});
+		}
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	@ConditionalOnMissingBean(AuthenticationProcessInterceptor.class)
+	static class OAuth2SecurityFilterChainConfiguration {
+
+		@Bean
+		@ConditionalOnBean(JwtDecoder.class)
+		@GlobalServerInterceptor
+		AuthenticationProcessInterceptor jwtSecurityFilterChain(GrpcSecurity http) throws Exception {
+			http.authorizeRequests((requests) -> requests.allRequests().authenticated());
+			http.oauth2ResourceServer((resourceServer) -> resourceServer.jwt(withDefaults()));
+			return http.build();
+		}
+
+	}
+
+	@Configuration(proxyBeanMethods = false)
+	@ConditionalOnMissingBean(JwtAuthenticationConverter.class)
+	@Conditional(JwtConverterPropertiesCondition.class)
+	static class JwtConverterConfiguration {
+
+		private final OAuth2ResourceServerProperties.Jwt properties;
+
+		JwtConverterConfiguration(OAuth2ResourceServerProperties properties) {
+			this.properties = properties.getJwt();
+		}
+
+		@Bean
+		JwtAuthenticationConverter getJwtAuthenticationConverter() {
+			JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
+			PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
+			map.from(this.properties.getAuthorityPrefix()).to(grantedAuthoritiesConverter::setAuthorityPrefix);
+			map.from(this.properties.getAuthoritiesClaimDelimiter())
+				.to(grantedAuthoritiesConverter::setAuthoritiesClaimDelimiter);
+			map.from(this.properties.getAuthoritiesClaimName())
+				.to(grantedAuthoritiesConverter::setAuthoritiesClaimName);
+			JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
+			map.from(this.properties.getPrincipalClaimName()).to(jwtAuthenticationConverter::setPrincipalClaimName);
+			jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter);
+			return jwtAuthenticationConverter;
+		}
+
+	}
+
+	private static class JwtConverterPropertiesCondition extends AnyNestedCondition {
+
+		JwtConverterPropertiesCondition() {
+			super(ConfigurationPhase.REGISTER_BEAN);
+		}
+
+		@ConditionalOnProperty(prefix = "spring.security.oauth2.resourceserver.jwt", name = "authority-prefix")
+		static class OnAuthorityPrefix {
+
+		}
+
+		@ConditionalOnProperty(prefix = "spring.security.oauth2.resourceserver.jwt", name = "principal-claim-name")
+		static class OnPrincipalClaimName {
+
+		}
+
+		@ConditionalOnProperty(prefix = "spring.security.oauth2.resourceserver.jwt", name = "authorities-claim-name")
+		static class OnAuthoritiesClaimName {
+
+		}
+
+	}
+
+}
--- a/spring-grpc-spring-boot-autoconfigure/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ b/spring-grpc-spring-boot-autoconfigure/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
@@ -7,3 +7,5 @@ org.springframework.grpc.autoconfigure.server.GrpcServerObservationAutoConfigura
 org.springframework.grpc.autoconfigure.server.GrpcServerReflectionAutoConfiguration
 org.springframework.grpc.autoconfigure.server.exception.GrpcExceptionHandlerAutoConfiguration
 org.springframework.grpc.autoconfigure.server.security.GrpcSecurityAutoConfiguration
+org.springframework.grpc.autoconfigure.server.security.OAuth2ClientAutoConfiguration
+org.springframework.grpc.autoconfigure.server.security.OAuth2ResourceServerAutoConfiguration