Identity crisis: bending Spring Security to your advanced use-cases
summary
Live coding shows an actual Spring Boot app using Spring Security 6 and Keycloak for OAuth2/OIDC, proving that PKCE (pixie) is safe for public clients, and that Spring Security 6.4’s templated expressions work for extracting claims. The demo builds a custom JWT authentication converter that, when a permitted admin sends a “login-as” cookie, fabricates a new JWT with the target user’s claims (fetched from a DB) so the backend treats requests as the impersonated user; the feature works in the demo and code is on GitLab.
AI-written summary · about
chapters (8)
- 0:00Spring Security challenges
- 7:57Why Spring Security feels overwhelming
- 10:03Backend vs frontend auth flows
- 18:58PKCE explained
- 20:02Templating meta annotations
- 26:04User impersonation use cases
- 33:33Implementing impersonation
- 42:08Q&A
related talks
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
54mIdentity Management to your Spring Boot applications
54mHow to secure your Spring Apps with Keycloak
48mModern Authentication Demystified: A Deep Dive into Spring Security’s Latest Innovations
51mEasily secure and add Identity Management to your Spring(Boot) applications
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
57mSpring Security for N00bz: A quick introduction for the terminally insecure
54mHow to secure your Spring apps with Keycloak