SlideShare une entreprise Scribd logo
1  sur  22
@lhazlewood | @goStormpath
Instant Security
& Scalable User Management
with Spring Boot
Les Hazlewood @lhazlewood
Apache Shiro Project Chair
CTO, Stormpath stormpath.com
@lhazlewood | @goStormpath
Spring Security
• Authentication
• Authorization
• Enforcement
• No user management
@lhazlewood | @goStormpath
You’re on the hook for:
• Data store integration
• Data modeling
• HTML pages
• CSRF view support
• Email verification
• Forgot password
• Oauth2 / Social setup
• SAML coordination
• Crypto choices
• Multi-factor auth
• Scale / growth
• SaaS Multi-Tenancy
• Mobile auth strategy
• Microservice auth
• Best practices
• ...etc...
@lhazlewood | @goStormpath
Traditional Application
Your
Application
Users
@lhazlewood | @goStormpath
What about new stores?
Users LDAP/AD
Your
Application
@lhazlewood | @goStormpath
And legacy migration?
Legacy
Users
LDAP/AD
New
Users
Your
Application
@lhazlewood | @goStormpath
And Social?
Legacy
Users
LDAP/AD
Google
Apps
Facebook GitHub
New
Users
Your
Application
@lhazlewood | @goStormpath
And SSO/SAML?
Legacy
Users
LDAP/AD
Google
Apps
Facebook GitHub
New
Users
Your
Application
Ping
Okta
Azure
ADFS
Oracle
SSO
SiteMinder
LinkedIn
OneLogin
@lhazlewood | @goStormpath
And Multi-Tenant / SaaS ?
Legacy
Users
LDAP/AD
Google
Apps
Facebook GitHub
New
Users
Your
Application
Ping
Okta
Azure
ADFS
Oracle
SSO SiteMinder LinkedIn
OneLogin
Customer A
Customer C
Customer F
Customer B
Customer D Customer E
Customer G
@lhazlewood | @goStormpath
Oh the Hue Manatee!
@lhazlewood | @goStormpath
Stormpath takes you from this...
Legacy
Users
LDAP/AD
Google
Apps
Facebook GitHub
New
Users
Your
Application
Ping
Okta
Azure
ADFS
Oracle
SSO SiteMinder LinkedIn
OneLogin
Customer A
Customer C
Customer F
Customer B
Customer D Customer E
Customer G
@lhazlewood | @goStormpath
To this...
Your
Application
@lhazlewood | @goStormpath
To this...
Your
Application
Your
Application
Your
Application
Your
Application
...
@lhazlewood | @goStormpath
But much more than a backend
• Application SDKs
• Framework Integrations
• Best practices
@lhazlewood | @goStormpath
Live Demo Time!
@lhazlewood | @goStormpath
Pages & Workflows
@lhazlewood | @goStormpath
SSO & Social
@lhazlewood | @goStormpath
OAuth & Mobile
@lhazlewood | @goStormpath
Flexible Authorization
@lhazlewood | @goStormpath
Application
Servlet Filters
How does it work?
Spring Security Stormpath MVC
Stormpath SDK
...
@lhazlewood | @goStormpath
Stormpath works hard for you
• Java SDK 1.0.0 released last Tuesday!
• SDK + Integration Effort: ~ 8 man years
• Extreme customizability
• Automatic defaults
• Often no code required
@lhazlewood | @goStormpath
Thank You!
• les@stormpath.com
• Twitter: @lhazlewood
• https://stormpath.com

Contenu connexe

Tendances

Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013
Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013
Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013
Gustaf Nilsson Kotte
 
Writing Secure SharePoint Code - SharePoint Saturday Toronto
Writing Secure SharePoint Code - SharePoint Saturday TorontoWriting Secure SharePoint Code - SharePoint Saturday Toronto
Writing Secure SharePoint Code - SharePoint Saturday Toronto
Eli Robillard
 
Ajax Security Dangers
Ajax Security DangersAjax Security Dangers
Ajax Security Dangers
drkimsky
 

Tendances (20)

Lies you have been told about REST
Lies you have been told about RESTLies you have been told about REST
Lies you have been told about REST
 
Usergrid Overview
Usergrid OverviewUsergrid Overview
Usergrid Overview
 
Mobile Authentication for iOS Applications - Stormpath 101
Mobile Authentication for iOS Applications - Stormpath 101Mobile Authentication for iOS Applications - Stormpath 101
Mobile Authentication for iOS Applications - Stormpath 101
 
Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013
Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013
Surviving the Zombie Apocalypse of Connected devices - Jfokus 2013
 
Writing Secure SharePoint Code - SharePoint Saturday Toronto
Writing Secure SharePoint Code - SharePoint Saturday TorontoWriting Secure SharePoint Code - SharePoint Saturday Toronto
Writing Secure SharePoint Code - SharePoint Saturday Toronto
 
Multi-Tenancy with Spring Boot
Multi-Tenancy with Spring Boot Multi-Tenancy with Spring Boot
Multi-Tenancy with Spring Boot
 
AJAX Security - LAC2016
AJAX Security - LAC2016AJAX Security - LAC2016
AJAX Security - LAC2016
 
HTTP Services & REST API Security
HTTP Services & REST API SecurityHTTP Services & REST API Security
HTTP Services & REST API Security
 
Token Authentication in ASP.NET Core
Token Authentication in ASP.NET CoreToken Authentication in ASP.NET Core
Token Authentication in ASP.NET Core
 
Starwest 2008
Starwest 2008Starwest 2008
Starwest 2008
 
Aws iam best practices to live by
Aws iam best practices to live byAws iam best practices to live by
Aws iam best practices to live by
 
IAM Best Practices
IAM Best PracticesIAM Best Practices
IAM Best Practices
 
Ajax Security Dangers
Ajax Security DangersAjax Security Dangers
Ajax Security Dangers
 
JWTs for CSRF and Microservices
JWTs for CSRF and MicroservicesJWTs for CSRF and Microservices
JWTs for CSRF and Microservices
 
Security vulnerabilities decomposition
Security vulnerabilities decompositionSecurity vulnerabilities decomposition
Security vulnerabilities decomposition
 
Mobile Application Scan and Testing
Mobile Application Scan and TestingMobile Application Scan and Testing
Mobile Application Scan and Testing
 
OAuth in the new .NET world (OWIN)
OAuth in the new .NET world (OWIN)OAuth in the new .NET world (OWIN)
OAuth in the new .NET world (OWIN)
 
Colabora.dk - Azure PTA vs ADFS vs Desktop SSO
Colabora.dk - Azure PTA vs ADFS vs Desktop SSOColabora.dk - Azure PTA vs ADFS vs Desktop SSO
Colabora.dk - Azure PTA vs ADFS vs Desktop SSO
 
IAM Best Practices
IAM Best PracticesIAM Best Practices
IAM Best Practices
 
Making Sense of API Access Control
Making Sense of API Access ControlMaking Sense of API Access Control
Making Sense of API Access Control
 

En vedette

Single-Page-Application & REST security
Single-Page-Application & REST securitySingle-Page-Application & REST security
Single-Page-Application & REST security
Igor Bossenko
 

En vedette (18)

REST API Security: OAuth 2.0, JWTs, and More!
REST API Security: OAuth 2.0, JWTs, and More!REST API Security: OAuth 2.0, JWTs, and More!
REST API Security: OAuth 2.0, JWTs, and More!
 
Custom Data Search with Stormpath
Custom Data Search with StormpathCustom Data Search with Stormpath
Custom Data Search with Stormpath
 
JWTs in Java for CSRF and Microservices
JWTs in Java for CSRF and MicroservicesJWTs in Java for CSRF and Microservices
JWTs in Java for CSRF and Microservices
 
Getting Started With Angular
Getting Started With AngularGetting Started With Angular
Getting Started With Angular
 
Beautiful REST+JSON APIs with Ion
Beautiful REST+JSON APIs with IonBeautiful REST+JSON APIs with Ion
Beautiful REST+JSON APIs with Ion
 
Storing User Files with Express, Stormpath, and Amazon S3
Storing User Files with Express, Stormpath, and Amazon S3Storing User Files with Express, Stormpath, and Amazon S3
Storing User Files with Express, Stormpath, and Amazon S3
 
Building Beautiful REST APIs in ASP.NET Core
Building Beautiful REST APIs in ASP.NET CoreBuilding Beautiful REST APIs in ASP.NET Core
Building Beautiful REST APIs in ASP.NET Core
 
Stormpath 101: Spring Boot + Spring Security
Stormpath 101: Spring Boot + Spring SecurityStormpath 101: Spring Boot + Spring Security
Stormpath 101: Spring Boot + Spring Security
 
Build a REST API for your Mobile Apps using Node.js
Build a REST API for your Mobile Apps using Node.jsBuild a REST API for your Mobile Apps using Node.js
Build a REST API for your Mobile Apps using Node.js
 
Browser Security 101
Browser Security 101 Browser Security 101
Browser Security 101
 
Elegant Rest Design Webinar
Elegant Rest Design WebinarElegant Rest Design Webinar
Elegant Rest Design Webinar
 
Build A Killer Client For Your REST+JSON API
Build A Killer Client For Your REST+JSON APIBuild A Killer Client For Your REST+JSON API
Build A Killer Client For Your REST+JSON API
 
Building Secure User Interfaces With JWTs (JSON Web Tokens)
Building Secure User Interfaces With JWTs (JSON Web Tokens)Building Secure User Interfaces With JWTs (JSON Web Tokens)
Building Secure User Interfaces With JWTs (JSON Web Tokens)
 
Token Authentication for Java Applications
Token Authentication for Java ApplicationsToken Authentication for Java Applications
Token Authentication for Java Applications
 
Building Beautiful REST APIs with ASP.NET Core
Building Beautiful REST APIs with ASP.NET CoreBuilding Beautiful REST APIs with ASP.NET Core
Building Beautiful REST APIs with ASP.NET Core
 
Single-Page-Application & REST security
Single-Page-Application & REST securitySingle-Page-Application & REST security
Single-Page-Application & REST security
 
Build a Node.js Client for Your REST+JSON API
Build a Node.js Client for Your REST+JSON APIBuild a Node.js Client for Your REST+JSON API
Build a Node.js Client for Your REST+JSON API
 
So long scrum, hello kanban
So long scrum, hello kanbanSo long scrum, hello kanban
So long scrum, hello kanban
 

Similaire à Instant Security & Scalable User Management with Spring Boot

Techniques for scaling application with security and visibility in cloud
Techniques for scaling application with security and visibility in cloudTechniques for scaling application with security and visibility in cloud
Techniques for scaling application with security and visibility in cloud
Akshay Mathur
 
cloud session uklug
cloud session uklugcloud session uklug
cloud session uklug
dominion
 

Similaire à Instant Security & Scalable User Management with Spring Boot (20)

DataCanvas: Big Data Analytic Flow in Cloud
DataCanvas: Big Data Analytic Flow in CloudDataCanvas: Big Data Analytic Flow in Cloud
DataCanvas: Big Data Analytic Flow in Cloud
 
SPS Chevy Chase Tips on migrating to Office 365
SPS Chevy Chase Tips on migrating to Office 365SPS Chevy Chase Tips on migrating to Office 365
SPS Chevy Chase Tips on migrating to Office 365
 
Techniques for scaling application with security and visibility in cloud
Techniques for scaling application with security and visibility in cloudTechniques for scaling application with security and visibility in cloud
Techniques for scaling application with security and visibility in cloud
 
SharePoint Tips and Tricks to avoid migration headaches
SharePoint Tips and Tricks to avoid migration headachesSharePoint Tips and Tricks to avoid migration headaches
SharePoint Tips and Tricks to avoid migration headaches
 
INTERFACE by apidays 2023 - GraphQL's second act, Jesse Martin, Hasura
INTERFACE by apidays 2023 - GraphQL's second act, Jesse Martin, HasuraINTERFACE by apidays 2023 - GraphQL's second act, Jesse Martin, Hasura
INTERFACE by apidays 2023 - GraphQL's second act, Jesse Martin, Hasura
 
Automating SharePoint Processes with Microsoft Flow - SPSBangalore
Automating SharePoint Processes with Microsoft Flow - SPSBangaloreAutomating SharePoint Processes with Microsoft Flow - SPSBangalore
Automating SharePoint Processes with Microsoft Flow - SPSBangalore
 
Rest + Oauth Integration by Lightning By Mohammed Rizwan
Rest + Oauth Integration by Lightning By Mohammed RizwanRest + Oauth Integration by Lightning By Mohammed Rizwan
Rest + Oauth Integration by Lightning By Mohammed Rizwan
 
The Ball Launch on 2013 Microsoft TechDays Part 1/2
The Ball Launch on 2013 Microsoft TechDays Part 1/2The Ball Launch on 2013 Microsoft TechDays Part 1/2
The Ball Launch on 2013 Microsoft TechDays Part 1/2
 
cloud session uklug
cloud session uklugcloud session uklug
cloud session uklug
 
Architect’s Open-Source Guide for a Data Mesh Architecture
Architect’s Open-Source Guide for a Data Mesh ArchitectureArchitect’s Open-Source Guide for a Data Mesh Architecture
Architect’s Open-Source Guide for a Data Mesh Architecture
 
SPS Toronto 2015
SPS Toronto 2015SPS Toronto 2015
SPS Toronto 2015
 
SharePoint Adoption Tactics - SPSPhilly
SharePoint Adoption Tactics - SPSPhillySharePoint Adoption Tactics - SPSPhilly
SharePoint Adoption Tactics - SPSPhilly
 
Using sharepoint to solve business problems #spsnairobi2014
Using sharepoint to solve business problems #spsnairobi2014Using sharepoint to solve business problems #spsnairobi2014
Using sharepoint to solve business problems #spsnairobi2014
 
#SPSOttawa introduction to the #microsoftGraph
#SPSOttawa introduction to the #microsoftGraph#SPSOttawa introduction to the #microsoftGraph
#SPSOttawa introduction to the #microsoftGraph
 
Building a New Platform for Customer Analytics
Building a New Platform for Customer Analytics Building a New Platform for Customer Analytics
Building a New Platform for Customer Analytics
 
Edge API BaaS Deep-Dive: Streamline app development
Edge API BaaS Deep-Dive: Streamline app developmentEdge API BaaS Deep-Dive: Streamline app development
Edge API BaaS Deep-Dive: Streamline app development
 
Architecting for Big Data: Trends, Tips, and Deployment Options
Architecting for Big Data: Trends, Tips, and Deployment OptionsArchitecting for Big Data: Trends, Tips, and Deployment Options
Architecting for Big Data: Trends, Tips, and Deployment Options
 
A6 big data_in_the_cloud
A6 big data_in_the_cloudA6 big data_in_the_cloud
A6 big data_in_the_cloud
 
Making Big Data Easy for Everyone
Making Big Data Easy for EveryoneMaking Big Data Easy for Everyone
Making Big Data Easy for Everyone
 
BAR360 open data platform presentation at DAMA, Sydney
BAR360 open data platform presentation at DAMA, SydneyBAR360 open data platform presentation at DAMA, Sydney
BAR360 open data platform presentation at DAMA, Sydney
 

Dernier

Dernier (20)

Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
JohnPollard-hybrid-app-RailsConf2024.pptx
JohnPollard-hybrid-app-RailsConf2024.pptxJohnPollard-hybrid-app-RailsConf2024.pptx
JohnPollard-hybrid-app-RailsConf2024.pptx
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Platformless Horizons for Digital Adaptability
Platformless Horizons for Digital AdaptabilityPlatformless Horizons for Digital Adaptability
Platformless Horizons for Digital Adaptability
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
AI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by AnitarajAI in Action: Real World Use Cases by Anitaraj
AI in Action: Real World Use Cases by Anitaraj
 
Six Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal OntologySix Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal Ontology
 

Instant Security & Scalable User Management with Spring Boot

Notes de l'éditeur

  1. Pages & Workflows SSO & Social OAuth & Mobile Flexible Authorization