application-oauth2.properties

# OAuth2 - Unified config for all providers (Okta, Google, custom)
# Provide values via environment variables. Never store in source code.
# AuthConfigProvider filters out registrations with clientId=xxxxxx.
# JWT issuer: OAUTH_JWT_ISSUER, or OAUTH_ISSUER for Okta, or Google default.

# Okta
spring.security.oauth2.client.registration.okta.client-id=${OAUTH_CLIENTID:xxxxxx}
spring.security.oauth2.client.registration.okta.client-secret=${OAUTH_CLIENTSECRET:xxxxxx}
spring.security.oauth2.client.provider.okta.issuer-uri=${OAUTH_ISSUER:https://accounts.google.com}
spring.security.oauth2.client.provider.okta.groups-claim=roles

# Google (CommonOAuth2Provider.GOOGLE provides default endpoints)
spring.security.oauth2.client.registration.google.client-id=${OAUTH_GOOGLE_CLIENT_ID:xxxxxx}
spring.security.oauth2.client.registration.google.client-secret=${OAUTH_GOOGLE_CLIENT_SECRET:xxxxxx}
spring.security.oauth2.client.registration.google.scope=openid,profile,email

# JWT resource server - primary issuer for bearer token validation
spring.security.oauth2.resourceserver.jwt.issuer-uri=${OAUTH_JWT_ISSUER:${OAUTH_ISSUER:https://accounts.google.com}}