Evolution of UAA Towards OAuth 2.1 and OpenID Foundation

on YouTube ↗15m

" summary

UAA migrates from OAuth 2.0 patterns to OAuth 2.1 behaviors and OpenID Foundation features, replacing legacy Spring Security/JWT stacks with newer libraries (Bouncy Castle for FIPS) and enabling higher JWT algorithms like RS512; work includes FIPS support, RS512 JWTs, and planned Spring Boot 3 and OpenSAML-4 upgrades. Client secrets move toward key-based auth and mutual TLS, public client flows replace empty-secret hacks, and X.509/technical authentication is on the roadmap; community-driven patches and Github PRs are already integrated.

AI-written summary · about

" chapters (6)

1. 0:00Introduction and UAA update
2. 3:15UAA in Cloud Foundry
3. 6:28Challenges and deprecations
4. 8:14Library and protocol renovations
5. 10:41OAuth 2.1 and OpenID improvements
6. 13:30Future plans and contributions

" related talks

• 41mUAA Feature Updates and 2017 RoadmapSree Tummidi · Cloud Foundry Summit Silicon Valley 2017
• 44mUAA Project Updates and Roadmap - Sree Tummidi, PivotalSree Tummidi · Cloud Foundry Summit Europe 2017
• 01h 02mOAuth in 2021 – What’s up?Dominick Baier · NDC London 2021
• 58mOAuth – the good PartsDominick Baier · NDC Porto 2022
• 58m“OAuth 2.1” and beyondDominick Baier · NDC Oslo 2020
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 42mFrom Basic Auth to OAuth: Migrating securityNikolai Neugebauer · JCON 2020
• 25mOAuth 2.1: The Future of API SecurityRob Allen · phpday 2025