Introduction

The Cloud Security "Hands-On" Workshop

Learning targets

This is a workshop on building secure cloud-native applications using spring cloud security (OAuth 2.0 and OpenID Connect).

This workshop is the hands-on part of the cloud security presentation.

Learning targets:

• Interact with an Identity Provider (like Auth0 or Keycloak)

• Learn how to authenticate on client and server side using OAuth2 and OpenID Connect

• Development using Spring Boot and Spring Security

OAuth 2.0/OpenID Connect Security Workshop Tutorial

We will extend the existing two microservices to use single sign authentication based on OAuth 2.0 and OpenID Connect (OIDC).

• Auth0 Identity Provider: This is central identity provider for single sign on which holds all users with their credentials

• OAuth2/OIDC Resource Server (product-initial): The microservice providing product data maps to a resource server

• OAuth2/OIDC Client (ui-initial): The thymeleaf UI microservice consuming the products maps to an OAuth2/OIDC client

These microservices have to be configured to be reachable via the following URL addresses (Port 8080 is the default port in spring boot).

Service URL Adresses

Service	URL
Identity Provider	https://access-me.eu.auth0.com
Client (UI)	http://localhost:9095/client
Resource Server (Products)	http://localhost:9090/server

Note: You can find more information on building OAuth 2.0/OIDC secured microservices with spring in Spring Boot Reference Documentation and in Spring Security Reference Documentation