Explore Java Enterprise security, focusing on authentication, authorization, and information security. Gain insights into encoding, encryption, and hashing. Discover OAuth2 and OpenID Connect integration techniques.

new.tar.gz

taskOne

tasktwo

taskthree

formPF

oauth2

openid

ldap

hashing

JWTHello

JWKManager

JwtAuthCode

demo

Challenge 1

Challenge2

Challenge3

simple-hash

hash-with-salt

PBKD

Challenge2-Faizan

Challenge3-Faizan

This course covers authentication and authorization within web applications in Java Enterprise security. Security is a vast concept with many aspects. In particular, we'll focus on the security of applications and the data they contain, an area that is known as information security.

We will start by identifying our end users and dive deep into the differences between encoding, encryption, and hashing techniques. After that, we will learn to propagate information with microservices architecture.

By the end of this course, you'll have hands-on experience with the integration and configuration of OAuth2 and OpenID Connect into the Java application.

JakartaEE Security Workshop

# Overview

OAuth2 is only designed to handle the authorization aspects of user data that are stored at some location. In the lesson "[Callback Handlers](https://www.educative.io/courses/jakarta-ee-security-workshop/callback-handlers)," our application doesn’t know the end user that accesses our application. It just receives an access token that can be used to retrieve some data. We don’t know the name, email address, avatar image, or permissions of that user. However, in the example, we can find out the name of the user, as that is part of the returned JSON for the Calendar events.

The name, email address, avatar image, and permissions can be handled and retrieved from an OAuth2 system. The purpose of the OpenID Connect specification is to standardize how these data are exchanged so that the principles of OAuth2 can be used for authentication purposes.

There are various sub-specifications for OpenID Connect. The two most important ones are the core specification, which determines how authentication through OpenID Connect can be done, and the discovery specification, which makes configuration much easier.

In other ways, OpenID Connect resembles how OAuth2 works but adds the additional step of retrieving an ID token. In this signed JSON Web Token (more on JWT in the chapter “[Secure Data Transfer](https://www.educative.io/courses/jakarta-ee-security-workshop/what-are-json-web-tokens-jwt)"), the user's basic information is present.

In the lesson [OpenID Connect example](https://www.educative.io/courses/jakarta-ee-security-workshop/openid-connect-example), we will integrate with one of the OpenID Connect providers available. This will help us see how the integration can be done using the Security API specification without going into detail about all the technology, like JWT, behind it.

# Configure Auth0
* Go [here](https://auth0.com/) and sign up to access the tool.
* On the left side, select the menu item Applications and start creating a new application using the “Create Application” button.
* Specify a name for your application and select  “Regular Web Application” as its type.
* Select the application name on the left in the menu and select the option Settings.

Get a brief introduction to OpenID connect and Configure Auth0 account setup.

OpenID Connect

Before We Begin

Introduction

Concepts

Window Shopping

Authentication Methods

Standards

Authentication Data Stores

Secure Data Transfer

OpenID Connect

Overview