Stateless Microservice Security via JWT, TomEE and MicroProfile
summary
Shows a concrete stateless security setup using MicroProfile JWT and Apache TomEE with an API gateway and backend microservices. Baseline simulates ~1,000 users at ~3 req/sec; access tokens are validated locally with a public key so LDAP/database load drops, while refresh tokens (demo uses 5min/1h tokens) remain revocable. Builds a small movie app where claims are injected into endpoints, uses @RolesAllowed for authorization, and demonstrates revocation by deleting a refresh token from the gateway — the demo works as shown.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker background
- 7:43Monolithic vs microservices architecture
- 10:10Security options for microservices
- 24:03Problems with OAuth2 and JWT basics
- 35:41MicroProfile specifications overview
- 38:17Demo setup and identity provider
- 46:22Q&A session
related talks
39mMicroservice Security via MicroProfile JWT
46mSecure microservices made easy with MicroProfile JWT
38mSecure Microservices Made Easy with MicroProfile JWT
49mFrom Zero to Secured: Jakarta REST with MicroProfile and JWT Authentication
46mImplementing Microservices Security Patterns & Protocols with Spring Security
47mDeconstructing and Evolving REST Security
01h 06mMicroservice Authentication and Authorization
35mSecure JAX-RS