Oauth2

Introduction Modern APIs need robust authentication to protect sensitive resources. MS Entra ID (formerly Azure Active Directory) provides enterprise-grade OAuth 2.0 authentication that integrates seamlessly with Spring Boot applications. In this article, you’ll learn how to: Register an application in MS Entra ID using Terraform Configure a Spring Boot API to validate OAuth 2.0 access tokens Implement API endpoint protection Test your secured API with real tokens This is the first article in a series on Spring Boot API security with MS Entra. Future articles will cover implementing role-based access control (RBAC) using app_roles and fine-grained authorization patterns. ...

Introduction Modern identity systems rely on standardized protocols to handle authentication and authorization. The three most important protocols you’ll encounter are OAuth 2.0, OpenID Connect (OIDC), and SAML. Understanding when to use each is crucial for building secure applications. OAuth 2.0: Authorization Framework OAuth 2.0 OAuth 2.0 is the industry-standard framework for delegated authorization, allowing third-party applications to access user data (e.g., Google Drive, Facebook) without exposing passwords. It works by issuing access tokens to applications via specific flows, such as Authorization Code or Client Credentials, enabling secure, limited access to resources. ...

Introduction Modern identity systems rely heavily on tokens to represent identity and authorization. Understanding the different types of tokens, their purposes, and lifecycles is essential for building secure applications. What is a Token? A token is a piece of data that represents something. In identity systems, tokens typically represent: Who you are (identity) What you can access (authorization) For how long (lifetime) Tokens are usually implemented as: JWT (JSON Web Token): Self-contained, can be validated without server calls Opaque tokens: Random strings that require server lookup Structured tokens: Custom formats specific to certain systems The Three Main Token Types 1. Access Token Purpose: Grants access to protected resources (APIs, services) ...