Security for Microservices with Spring and OAuth2

Recorded at SpringOne2GX 2014.

Speaker: Dr. David Syer

Slides: http://www.slideshare.net/SpringCentral/syer-microservicesecurity

OAuth2 is a lightweight security protocol that is well-suited for use with HTTP, the protocol at the heart of many modern architectures. Spring Security OAuth2 has a load of new features, not the least of which being the `@Configuration` support in version 2.0. Combine these with Spring Boot and you have a platform which can get you a secure HTTP service application in about 20 lines of code. This presentation shows how the combination of rapid development and production-ready features in the modern Spring stack are a perfect mixture for developing secure components in a system composed of microservices. We explore the new features in Spring OAuth2, guide you through the choice of which to use and when, and show how easy they are to enable quickly. This is the 90 minute version of the same talk that was on the Spring webinar program recently.

!{iframe width="560" height="315" src="//www.youtube.com/embed/MLfL1NpwUC4" frameborder="0" allowfullscreen}{/iframe}

Welcome to another installment of This Week in Spring! This week I'm at the Rich Web Experience in Ft. Lauderdale, FL, joining my pal Matt Stine for a workshop on building microservices with Spring Boot, Spring Cloud and Cloud Foundry.

So, without further ado, let's get to it:

• Dr. Dave Syer just announced the M3 release of Spring Cloud, complete with loads of cool stuff, including a smarter Ribbon-enabled load-balancing RestTemplate, a RabbitMQ-based aggregator for Hystrix Metrics based on Turbine 2, Spring Cloud for AWS support, and much more
• Spring ninja Sebastien Deleuze just announced some of the amazing new features in Spring's Jackson support. My favorite? JSON + XML marshalling with dynamic views. Views are a logical subset of attributes from a JSON structure that may be rendered dynamically.
• Check out Spring Roo 1.3.1 and includes bug-fixes for reverse engineering and third party addon installations. Thanks, community and Disid in particular for the updates!
• Spring and Groovy & Grails Tool Suite lead Martin Lippert just announced versions 3.6.3. The new release includes updated Spring Integration visualizations, a installed-by-default Cloud Foundry plugin and more. Check it out!
• Want to learn about the Spring Integration Java configuration DSL in terms of a working, line-by-line example? Check out this post by Java configuration DSL lead Artem Bilan and if you want to see how it works on JDK 7 or earlier, check out this post.
• Spring Data lead Oliver Gierke just announced the first milestone of the next Spring Data release train, Spring Data Fowler.
• The replay from the good Dr. David Syer's SpringOne2GX 2014 talk on security for microservices is now available online.
• Additionally, check out Dr. Syer and Spencer Gibb's talk introducing Spring Cloud to the world at SpringOne2GX 2014!
• Check out the SpringOne2GX 2014 replay of Reactor project ninjas Jon Brisbin and Stephane Maldini's talk: Building Reactive applications with Reactor and the Reactive Streams standard
• Join Spring Integration project-lead Gary Russell for a not-to-be-missed webinar on January 27th that introduces the just-released Spring Integration Java configuration DSL!
• You know what they say: go grid or go home! Or something like that…​ anyway, definitely check out my pal Luke Shannon's upcoming webinar on building scalable data applications with Spring Data Gemfire
• Adao Feliz put together a nice post on using Spring Boot and Docker. It's pretty straightforward, so check it out!
• The All and Sundry blog has a nice post on how to consume linked resources using Spring's RestTemplate.
• Check out the early bits for the next-gen Cloud Foundry built from the ground up on the Go language and supports Docker as a first-class citizen. If you know how to use Vagrant, it's dead simple to get a full working Cloud Foundry cloud running on your laptop if you follow these instructions. Do try it out and let us know!

Dear Spring Community!

Recently we published the Spring Integration Java DSL: Line by line tutorial, which uses Java 8 Lambdas extensively. We received some feedback that this is good introduction to the DSL, but a similar tutorial is needed for those users, who can't move to the Java 8 or aren't yet familiar with Lambdas, but wish to take advantage

So, to help those Spring Integration users who want to moved from XML configuration to Java & Annotation configuration, we provide this line-by-line tutorial to demonstrate that, even without Lambdas, we gain a lot from Spring Integration…

On behalf of the Spring Data team, I am happy to announce the first milestone of the Spring Data Release train Fowler.

The release ships 170 tickets fixed, 119 of them unique to the Fowler release train. Find a curated changelog here. The highlights of the release include:

• Upgrades to Spring 4.0.8 and Querydsl 3.6.0.
• Performance improvements in converter subsystem by using byte-code generation.
• Out-of-the-box support for JSR-310 date/time types (MongoDB).
• Various (performance) improvements in the usage of SpEL (JPA).
• Support for $bit, $mul and $position operators (MongoDB).
• Improved proxy-id detection for JPA and REST.
• Introdcution of QueryDslPredicateExceutor.findAll(OrderSpecifier<?>... orders) (Querydsl).
• CDI repository extension for Cassandra module.
• Upgrade to Gemfire 8 (Gemfire).
• Version property based ETag generation (REST).
• …

Spring Roo 1.3.1 RC1 Release Candidate is available.

Spring Roo jar files have been published to Maven Central. As always, the release is available in the Spring IO repository.

The candidate release fixes serious issues:

• running reverse engineering.
• installing third-party addons.

It is highly recommended that all Spring Roo users upgrade to this version.

For full details on the changes made in the release, please refer to the Release Note in Jira.

For more project specific information please see the Project Page and GitHub

Thanks to the awesome users who came up with useful bug reports and suggestions. This is a candidate release, please try out the updates and provide feedback. As always, you'll also find Roo on Twitter - either follow @SpringRoo or just include #SpringRoo in your tweets. Stay tuned!

Egads! Can you believe it's already almost the end of the year? Time has been screaming fast! It's the week of Thanksgiving for those of us in the United States. This is a wonderful time of year to sit back, find a nice Spring IO guide or blog to read, and then build something awesome.. oh, and it's an ideal time to spend in the company of friends and family and to reflect on those and that for which we're grateful. I'm sure I speak for the Spring team and Pivotal at large when I say that we're grateful for you, our inspiring community, users and customers.

But if you do want something to read…

Spring Cloud 1.0.0.M3 is available now in the repo.spring.io repository. The following projects all had a 1.0.0.M3 release:

• Spring Cloud Config: centralized key-value (or YAML) configuration management. Now supports the config server being fully embedded in another application.

• Spring Cloud Netflix. Also has better support for embeddability of the server components. Now also properly records load balancer statistics in Ribbon-enabled Spring RestTemplate.

• Spring Cloud for Amazon Web Services. Has new Spring Boot integration points, externalizing configuration for AWS metadata.

• Spring Cloud Security: super simple OAuth2 in a declarative style.

• Spring Cloud Bus: broadcasts framework-level events to Spring Cloud components. Big news here is that we now have a RabbitMQ-based aggregator for Hystrix metrics (based on Turbine 2), so you don't have to rely on having direct HTTP access to all service instances.

  …

Dear Spring Community!

Just after the Spring Integration Java DSL 1.0 GA release announcement I want to introduce the Spring Integration Java DSL to you as a line by line tutorial based on the classic Cafe Demo integration sample. We describe here Spring Boot support, Spring Framework Java and Annotation configuration, the IntegrationFlow feature and pay tribute to Java 8 Lambda support which was an inspiration for the DSL style. Of course, it is all backed by the Spring Integration Core project.

For those, who are not interested in Java 8 yet, we provide similar tutorial without Lambdas: Spring Integration Java DSL (pre Java 8): Line by line tutorial…

Dear Spring community,

As we promised in the Release Candidate blog post, we are pleased to announce that the Spring Integration Java DSL 1.0 GA is now available. As usual, use the Release Repository with Maven or Gradle, or download a distribution archive, to give it a spin.

See the project home page for more information.

First of all, we are glad to share with you that on Nov 12, 2014, DZone research recognized Spring Integration as the leader in the ESB / Integration framework space, leading with 42% marketshare, in a publication of their recent survey results. And the report is…