OAuth for Java Developers
Talkat JCON Europe 2023 · on Thursday, 2023-06-22· at 10:00· Cinema 9, Im Mediapark 1, 50670 Köln, Germany·
summary
Overview of concrete Java support: Jakarta Security 3.0 adds OpenID Connect support, Spring Security + Spring Boot works as both resource server and OIDC client, and Quarkus/Micronaut/Helidon accept microprofile JWT config; example repo (github.com/octodev/zero-java-oauth-examples) runs a Spring Boot demo that logs in via authorization code with PKCE and via device flow, exchanges codes for access and refresh tokens, and validates JWTs. OAuth 2.1 best practices (no implicit or resource‑owner password grants) and tooling notes (register clients, use PKCE, prefer managed auth servers like OCTA) are shown.
AI-written summary · about
chapters (13)
- 0:00Introduction and background
- 2:07Overview of the talk
- 3:20History of web authentication
- 6:08The problem OAuth solves
- 10:33Core OAuth terminology
- 15:23Scopes, consent, and flows
- 17:18Token management and security
- 22:23Grant types and OAuth 2.0 flows
- 25:23OpenID connect
- 29:59OAuth 2.1 and future standards
- 31:53OAuth in the Java ecosystem
- 35:41Demonstrations and code
- 40:59Conclusion and resources
related talks
45mOAuth and beyond: Modern auth not only for the web
01h 31mSecurity for Microservices with Spring and OAuth2
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
01h 03mNext Generation OAuth Support with Spring Security 5.0
56mSecured REST Microservices with Spring Cloud
43mOAuth2, OpenID: live-coding SSO, from first principles
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
49mFrom Zero to Secured: Jakarta REST with MicroProfile and JWT Authentication