Spring Security 6 with JWT and Spring Microservices

Explore how servlet filters intercept HTTP requests, enabling authentication and authorization, and how Spring security filter chains and delegating filter proxy select the correct chain.

Create a user entity for a Spring Security 6 with JWT microservices project by implementing UserDetails and defining username and password fields with account status methods and Hibernate entity annotations.

Set up the spring jwt database by installing mysql and workbench, create the database, and configure the ddl auto setting, url, username, password, and driver in application properties.

Configure spring security by adding a security config, enabling web security, and wiring a user details service and user repository to retrieve user objects from the database.

Configure the Spring authentication provider by creating a DAO authentication provider bean, wiring the user details service, and centralizing a bcrypt password encoder in a configuration class.

Create a demo rest controller with two endpoints under api v1: a public endpoint accessible by anyone and a protected endpoint secured against unauthenticated access, returning simple content strings.

Test spring authentication by running the app, enabling annotation processing, and using postman to compare public access with a 403 forbidden response for unauthenticated protected endpoints.

Create an auth controller to issue JWT tokens at /api/v1/auth/token. Authenticate users with username and password through the authentication manager and generate a JWT token with the JWT service.

Implement a JWT token filter in spring security 6 to read bearer tokens from authorization header, validate them, load user details, and set authentication before the username and authentication filter.

Use a fresh jwt from the token filter to access protected endpoints by sending a bearer token in the authorization header, showing authentication succeeds and 403 when missing.

Introduce roles in the user entity and map them to a simple granted authority, using prefixes like finance or R and D with Spring expression language to secure APIs.

Introduce an admin-only rest endpoint secured with a pre-authorize annotation requiring the admin role, enable method security, and attach the endpoint to the security chain.

Test authorization by using bearer tokens in Postman to access protected endpoints; user access yields 403, while admin tokens grant admin content, and removing the token blocks access.

Explore securing a library management system REST API with spring security 6 and JWT, updating endpoints to LMS, and enforcing admin-only data creation and token-based access via Postman.

Discover Keycloak, an open source identity and access management tool with single sign-on and role-based access control, centralizing user management across microservices and supporting password policies and email verification.

Set up Keycloak using Docker by installing Docker, verifying the version, and running a detached container with port 8080 mapping and admin credentials via environment variables.

Configure a Keycloak realm, create a backend client, and define admin and user roles. Map realm roles to client roles, create users with credentials, and assign roles.

Obtain a Keycloak authentication token by posting to the OpenID token endpoint with grant_type=password, client_id, username, and password in Postman; view access and refresh tokens and their scopes.

Configure a microservice with Keycloak by setting issuer URI and OpenID Connect JWT endpoint. Use Keycloak client ID as the JWT auth converter resource ID and enable debug logging.

Learn to build a JWT converter in Spring Security that transforms Keycloak JWT tokens into Spring authentication tokens, extracting resource access roles and principal attributes for secure microservices.

Implement a security configuration by creating a security config class, enabling web security, and securing admin and user endpoints with role-based access via JWT converters and non stateless session policy.

Test a spring microservice's admin and user endpoints using postman tokens. Verify access control with bearer tokens, including 403 forbidden for unauthorized users and success for admins.