JWT + OAuth2 Spring Boot : securiser 6 microservices Keycloak | System Design en 10 min #3

Your client authenticates via the Gateway. But behind it, there are 6 services. How do they trust each other? JWT, OAuth2, Keycloak: we're setting up full authentication. Chapters: 00:07 - 6 services, who trusts whom? 00:32 - Intro 01:04 - The 3 authentication problems 02:29 - JWT: token anatomy (header, payload, signature) 04:36 - Access token vs. Refresh token 06:10 - OAuth2 flows: Authorization Code vs. Client Credentials 07:48 - Keycloak: realm, roles, clients 09:25 - Comparison: Keycloak vs. Auth0 vs. Custom JWT (ADR #3) 11:26 - Context propagation in Kafka 12:56 - Implementation: Spring Security OAuth2 Resource Server 28:00 - JwtAuthConverter: mapping Keycloak roles 33:20 - Demo: obtaining a token, curl with/without a token 45:20 - Interview trap: where to store tokens 46:46 - Outro + teaser Video 4 In this video: The problem: 3 Types of communication to secure (user, service-to-service, Kafka) JWT: token anatomy, header, payload, RS256 signature Access token (5 min, stateless) vs. Refresh token (30 days, revocable) OAuth2 flows: Authorization Code + PKCE (front end) vs. Client Credentials (service) Keycloak: realm, roles (CLIENT, RESTAURANT, DRIVER), confidential clients Comparison: Keycloak vs. Auth0 vs. Custom JWT (ADR #3) Context propagation in Kafka: X-User-Id headers, X-Roles (no JWT) Implementation: Spring Security OAuth2 Resource Server + JwtAuthenticationConverter Maintenance pitfall: where to store tokens in a distributed architecture? Stack: Java 17 + Spring Boot 3.2 + Keycloak 24 + Spring Security OAuth2 + Kafka Source code: https://github.com/Deval123/quickbite “System Design in 10 min” series - Video 3/20 #JWT #OAuth2 #Keycloak #SpringSecurity #Microservices #Java #SpringBoot #Architecture #systemdesign 🔥 Subscribe to the channel: https://www.youtube.com/@devalere7345...