Book Image

Hands-On Spring Security 5 for Reactive Applications

By : Tomcy John
Book Image

Hands-On Spring Security 5 for Reactive Applications

By: Tomcy John

Overview of this book

Spring Security enables developers to seamlessly integrate authorization, authentication, and a range of security features for complex enterprise applications. This book provides a hands-on approach to developing reactive applications using Spring and will help you get up and running in no time. Complete with step-by-step explanations, practical examples, and self-assessment questions, the book begins by explaining the essential concepts of reactive programming, Spring Framework, and Spring Security. You’ll then learn about a variety of authentication mechanisms and how to integrate them easily with a Spring MVC application. You’ll also understand how to achieve authorization in a Spring WebFlux application using Spring Security. Furthermore, the book will take you through the configuration required to implement OAuth2 for securing REST APIs, and guide you in integrating security in microservices and serverless applications. Finally, you’ll be able to augment add-ons that will enhance any Spring Security module. By the end of the book, you’ll be equipped to integrate Spring Security into your Java enterprise applications proficiently.
Table of Contents (15 chapters)
Title Page
Copyright and Credits
Packt Upsell

Core Spring Security modules

In Spring Framework, Spring Security is a top-level project. Within the Spring Security project (, there are a number of sub-modules:

  • Core (spring-security-core): Spring security's core classes and interfaces on authentication and access control reside here.
  • Remoting (spring-security-remoting): In case you need Spring Remoting, this is the module with the necessary classes.
  • Aspect (spring-security-aspects): Aspect-Oriented Programming (AOP) support within Spring Security.
  • Config (spring-security-config): Provides XML and Java configuration support.
  • Crypto (spring-security-crypto): Contains cryptography support.
  • Data (spring-security-data): Integration with Spring Data.
  • Messaging (spring-security-messaging)
  • OAuth2: Support for OAuth 2.x support within Spring Security:
    • Core (spring-security-oauth2-core)
    • Client (spring-security-oauth2-client)
    • JOSE (spring-security-oauth2-jose)
  • OpenID (spring-security-openid): OpenID web-authentication support.
  • CAS (spring-security-cas): CAS (Central Authentication Service) client integration.
  • TagLib (spring-security-taglibs): Various tag libraries regarding Spring Security.
  • Test (spring-security-test): Testing support.
  • Web (spring-security-web): Contains web security infrastructure code, such as various filters and other Servlet API dependencies.

These are the top-level projects within Spring Framework that are strongly linked to Spring Security:

  • spring-ldap: Simplifying Lightweight Directory Access Protocol (LDAP) programming in Java.
  • spring-security-oauth: Easy programming with OAuth 1.x and OAuth 2.x protocols.
  • spring-security-saml: Bringing the SAML 2.0 service provider capabilities to Spring applications.
  • spring-security-kerberos: Bringing easy integration of Spring application with Kerberos protocol.

Security Assertion Markup Language (SAML) is an XML-based framework for ensuring that transmitted communications are secure. SAML defines mechanisms to exchange authentication, authorization, and non-repudiation information, allowing single sign-on capabilities for Web services.

The Lightweight Directory Access Protocol (LDAP) is a directory service protocol that runs on a layer above the TCP/IP stack. Its based on a client-server model and provides a mechanism used to connect to, search, and modify Internet directories.

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret key cryptography. A free implementation of this protocol is available from MIT and it is also available in many commercial products.


For more information about SAML, LDAP, and Kerberos, you can check the following links: