title: Spring Authorization Server. What's the difference between RegistredClient and UserDetails?
body: <p>On their Getting started guide, <a href="https://docs.spring.io/spring-authorization-server/docs/current/reference/html/getting-started.html" rel="nofollow noreferrer">reference</a>, Spring Authorization Server have a piece of code where they declare two beans - UserDetailsService and RegistredClientRepository. I wanted to play around retrieving some tokens from the server. I tried using postman. Within authorization tab I entered the values from the guide:
  <a href="https://i.stack.imgur.com/Fi8hH.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Fi8hH.png" alt="enter image description here" /></a></p>
  <p>it answered with:</p>
  <p><a href="https://i.stack.imgur.com/g90KE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/g90KE.png" alt="enter image description here" /></a></p>
  <p>So then I tried inputting client credentials from RegistredClientRepository entry:</p>
  <p><a href="https://i.stack.imgur.com/SFlcD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/SFlcD.png" alt="enter image description here" /></a></p>
  <p>And it worked.</p>
  <p>So my question is: what is the purpose of UserDetails and RegistredClient being both available in this case?</p>
  <p>And another little bit off-topic question: if I create my own authorization server for client credentials flow between my servers, how does every server know that token belongs to legitimate server and not to some attacker who can just register with needed clientId if there's an opportunity? How can resource server actually verify that token owner is the server it trusts?</p>