Architectural Patterns for Spring Security You Wish Your Tech Lead Knew
summary
Shows a concrete microservice setup: an OAuth2/OIDC auth client, a Spring Cloud gateway, and two resource servers that either accept JWTs or opaque-token exchange values. Uses Keycloak for IDP brokering, converts incoming JWTs to UUID opaque tokens cached at the gateway, and implements an introspection endpoint per RFC 7662 so downstream services call back for attributes. Demo wires the cache, TTL and basic-auth introspection, proving immediate revocation and simpler internal auth; recommends hybrid JWT-at-edge + opaque-internal and per-domain authZ services.
AI-written summary · about
chapters (8)
- 0:00Spring Security architecture
- 2:50Scaling challenges
- 6:02Multi-IDP federation
- 18:30Auth strategies
- 25:11BFF security pattern
- 27:37Gateway token conversion demo
- 44:31Key takeaways
- 46:18Q&A
related talks
46mImplementing Microservices Security Patterns & Protocols with Spring Security
56mSecured REST Microservices with Spring Cloud
01h 30mSecuring Microservices with Spring Cloud Security
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
43mIdentity crisis: bending Spring Security to your advanced use-cases
01h 31mSecurity for Microservices with Spring and OAuth2
43mSecuring the Service to Service Call Chain Patterns and Protocols
54mHow to secure your Spring apps with Keycloak