👀 Views: 2 💬 Answers: 1 📅 Created: 2025-09-20

OCI OAuth2 Spring Security Microservices Authentication java

I'm sure I'm missing something obvious here, but Hey everyone, I'm running into an issue that's driving me crazy... Trying to implement OAuth2 authentication in our microservices architecture hosted on Oracle Cloud Infrastructure (OCI). Our setup involves multiple services communicating over REST APIs, and we need to ensure that they authenticate properly before allowing any access to sensitive resources. During the code review, I noticed some inconsistent implementations across different services. For instance, the authorization server is set up using Spring Security with OAuth2, while one of our services is still using basic authentication. This inconsistency raises security concerns and might lead to vulnerabilities. Here’s the basic configuration I have for the authorization server: ```java @Configuration @EnableAuthorizationServer public class AuthServerConfig extends AuthorizationServerConfigurerAdapter { @Override public void configure(ClientDetailsServiceConfigurer clients) throws Exception { clients.inMemory() .withClient("client_id") .secret(passwordEncoder().encode("client_secret")) .authorizedGrantTypes("authorization_code", "refresh_token") .scopes("read", "write"); } } ``` While reviewing the client services, I found that the access tokens aren't being validated correctly. Each service is supposed to check the token against the public key of the authorization server, but I found instances where the token validation logic is missing entirely. Here’s how I’m currently validating the token: ```java @Bean public JwtDecoder jwtDecoder() { return NimbusJwtDecoder.withJwkSetUri("https://your-authorization-server/.well-known/jwks.json").build(); } ``` However, I suspect that this might lead to performance issues due to the network round trip to validate the token. I’m considering using a caching layer for the public keys to mitigate this. Moreover, in another service, I noticed the token expiration logic isn’t being handled correctly. Tokens are set to expire after 15 minutes, but the service continues to accept expired tokens due to poor implementation. The code snippet below shows the current check: ```java if (token.isExpired()) { throw new InvalidTokenException("Token has expired"); } ``` This needs to be more robust, possibly by introducing a refresh token flow to maintain user sessions without constant re-authentication. I’m also aware that some services are not properly logging authentication events, which could hinder our ability to audit and monitor access patterns. I've started integrating Spring Actuator to expose health checks and metrics, including security-related information, but I need to ensure these logs are collected and monitored effectively. Would love to hear any tips or best practices on how to streamline this authentication mechanism across multiple microservices in OCI, tackle the performance issues related to token validation, and make sure we are adhering to security best practices. Any recommended libraries or patterns that could help with these challenges would also be appreciated. Any ideas what could be causing this? I'm coming from a different tech stack and learning Java. Is there a better approach?