Add reference documentation

[jgrandja]

This issue will serve to provide a content outline for the reference documentation.

Our goal is to avoid the "fluff" and only write content that will be valuable to our users and community. The only way to achieve this is too directly involve our users in driving out the content they want to see.

We'll be prioritizing the "How-to" Guides based on upvotes. Please log an issue for a new How-to Guide if it's not already listed.

We also encourage users to log an issue recommending new content that is not already listed in the proposed content outline.

[jgrandja]

Content Outline ("Draft")

1. Overview
   • Introducing Spring Authorization Server
   • Feature List
2. Getting Help
3. Getting Started
   • System Requirements
   • Installing Spring Authorization Server
   • Developing Your First Spring Authorization Server Application
4. Configuration Model
   • OAuth2AuthorizationServerConfigurer
   • OAuth2AuthorizationServerConfiguration
   • ProviderSettings / ProviderContext
5. Core Model / Components
   • RegisteredClientRepository / RegisteredClient
   • OAuth2AuthorizationService / OAuth2Authorization
   • OAuth2AuthorizationConsentService / OAuth2AuthorizationConsent
   • OAuth2TokenGenerator
   • OAuth2TokenCustomizer
6. Protocol Endpoints
   • OAuth 2.0 Authorization Endpoint
   • OAuth 2.0 Token Endpoint
   • OAuth 2.0 Token Introspection Endpoint
   • OAuth 2.0 Token Revocation Endpoint
   • OAuth 2.0 Authorization Server Metadata Endpoint
   • JWK Set Endpoint
   • OpenID Connect 1.0 Provider Configuration Endpoint
   • OpenID Connect 1.0 UserInfo Endpoint
   • OpenID Connect 1.0 Client Registration Endpoint
7. "How-to" Guides
   • Obtain an access token using a specific grant_type:
     • authorization_code
     • client_credentials
     • refresh_token
   • Customize form based login
   • Authenticate a user with two-factor authentication
   • Customize the user consent page
   • Authenticate using OpenID Connect 1.0 authorization_code flow
   • Customize the OpenID Connect 1.0 UserInfo response
   • Authenticate using social login, e.g. Google
   • Authenticate a user in a Single Page Application with PKCE
   • Customize client authentication for specific authentication methods
   • Handle errors and customize the OAuth 2.0 Error response
   • Authorize an access token containing custom authorities, e.g. roles, groups, permissions, etc.
     • Customize the headers / claims in a JWT
   • Deny access for a revoked JWT access token
     • Introspect / revoke an access token
   • Provide a JWK source backed by a key rotation strategy
   • Implement the core services with JPA:
     • RegisteredClientRepository
     • OAuth2AuthorizationService
     • OAuth2AuthorizationConsentService
8. Appendices