How to secure SpringBoot REST APIs using AzureAD B2C OAuth2 scopes?

แชร์
ฝัง
  • เผยแพร่เมื่อ 1 ธ.ค. 2024

ความคิดเห็น • 34

  • @securityinaction1018
    @securityinaction1018  10 หลายเดือนก่อน +1

    Please subscribe to this channel for regular updates th-cam.com/channels/EEayyyCrJO94FYlzF0NLTg.html
    Thank You for the support.

  • @shikhinmisra8671
    @shikhinmisra8671 4 หลายเดือนก่อน

    I don't know why your videos have less views. Have been learning from youtube since 15 years but never found anyone creating POCs by referring to the actual documentations. Your approach really gives a lot of confidence! Needless to mention that the topics you cover are really difficult to find elsewhere. Great content!

    • @securityinaction1018
      @securityinaction1018  4 หลายเดือนก่อน

      Thank you so much !! I will keep trying my best to post quality videos.
      Please like, subscribe & share this video / channel !! Thanks in advance.

  • @CalmFirst-p3y
    @CalmFirst-p3y 8 หลายเดือนก่อน +1

    This was an excellent video, thanks for sharing it!

    • @securityinaction1018
      @securityinaction1018  8 หลายเดือนก่อน

      Thank you.
      Please like, subscribe & share!! Thanks in advance.

  • @papidulzuratravel8715
    @papidulzuratravel8715 3 หลายเดือนก่อน

    You just help me immensely with a current issue! ❤

    • @securityinaction1018
      @securityinaction1018  3 หลายเดือนก่อน

      Glad it helped!!
      Please like, subscribe & share this video / channel !! Thanks in advance.

  • @akhilkumar872
    @akhilkumar872 2 หลายเดือนก่อน

    Perfect timing, please share the Github repos too for future videos, it would be awesome

    • @securityinaction1018
      @securityinaction1018  2 หลายเดือนก่อน

      Sure.
      Please like, subscribe & share this video / channel !! Thanks in advance.

  • @ViswanathTumbalamGooty
    @ViswanathTumbalamGooty 5 หลายเดือนก่อน +1

    Good video - One quick question, in step-4 said that the token will get validated... how and where the token will get validated ?

    • @securityinaction1018
      @securityinaction1018  5 หลายเดือนก่อน

      All these validations are taken care by SpringBoot security classes. You can customize this which is generally not required. Refer this documentation for more details : docs.spring.io/spring-security/reference/servlet/oauth2/login/advanced.html#oauth2login-advanced-idtoken-verify
      Please like, subscribe & share this video to support this channel !! Thanks in advance.

  • @helencode
    @helencode 3 หลายเดือนก่อน

    What is diference between Azure AD B2c and Entra Id in configuration. And which one i should use. Thank you

    • @securityinaction1018
      @securityinaction1018  3 หลายเดือนก่อน

      Here are some links which will clear the confusion :
      learn.microsoft.com/en-us/answers/questions/1556632/confusion-around-azure-ad-b2c-vs-microsoft-entra-e
      learn.microsoft.com/en-us/entra/external-id/customers/faq-customers#is-microsoft-entra-external-id-a-new-name-for-azure-ad-b2c
      Please like, subscribe & share this video / channel !! Thanks in advance.

  • @christianrazvan
    @christianrazvan 10 หลายเดือนก่อน

    Some of the blades are missing in Azure B2C

  • @ScoobyDoo-ct9nd
    @ScoobyDoo-ct9nd 8 หลายเดือนก่อน

    Explained very well and really excellent!!!

    • @securityinaction1018
      @securityinaction1018  8 หลายเดือนก่อน

      Glad you liked it!!
      Please like, subscribe & share!! Thanks in advance.

  • @rinciyacolaco2919
    @rinciyacolaco2919 หลายเดือนก่อน

    I am getting unable to resolve configuration with the provided issuer of"" error. Can you help me with this error .

    • @securityinaction1018
      @securityinaction1018  หลายเดือนก่อน

      Looks like somewhere the configuration specifies issuer as empty string. Is this error thrown during SpringBoot server start process?

    • @rinciyacolaco2919
      @rinciyacolaco2919 หลายเดือนก่อน

      @@securityinaction1018 i am getting this error when i try to hit the url in postman to getuser with token

    • @securityinaction1018
      @securityinaction1018  หลายเดือนก่อน

      It's difficult to debug without seeing the issue. I am not sure where the issue is happening. You can enable debug logs in SpringBoot app and see if you can find any details there

    • @rinciyacolaco2919
      @rinciyacolaco2919 หลายเดือนก่อน

      @@securityinaction1018 i tried debugging the application.. but that’s not possible… whenever i hit the localhost url in postman i m getting 401 error and in logs i can see jwtdecoderinitializationexpection: failed to lazily resolve the supplied jwtdecoder i stance

    • @securityinaction1018
      @securityinaction1018  หลายเดือนก่อน

      Ok. If it is ok with you, post the spring application.yaml file configuration here. I think something might be wrong in that config.

  • @satyarajGovindaDas
    @satyarajGovindaDas 8 หลายเดือนก่อน

    Great video and explaination. Though the Azure portal have few changes than this video but the concept remained pretty much same. I followed everything as per your video and verified with Azure documentation too, but I'm getting Invalid grant type.(value=client_credentials). Please help to resolve

    • @securityinaction1018
      @securityinaction1018  8 หลายเดือนก่อน

      Thank you. Please check if "accessTokenAcceptedVersion" in the manifest file is set to 2 as mentioned in this document learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-user-flow#step-2-register-an-application
      Please like, subscribe & share!! Thanks in advance.

    • @satyarajGovindaDas
      @satyarajGovindaDas 8 หลายเดือนก่อน

      @@securityinaction1018 yes it is. All the steps mentioned in your video and the Azure documentation was followed strictly.

    • @securityinaction1018
      @securityinaction1018  8 หลายเดือนก่อน

      It's pretty difficult to debug without seeing the setup. One more thing I can think of is the "Application ID URI" as mentioned in this document learn.microsoft.com/en-us/azure/active-directory-b2c/client-credentials-grant-flow?pivots=b2c-user-flow#step-11-define-web-api-roles-scopes. Please make sure it is configured as mentioned in the video.

    • @satyarajGovindaDas
      @satyarajGovindaDas 8 หลายเดือนก่อน

      @@securityinaction1018 yes, the verified and even recreated Application ID URI with new unique ID. still no luck

    • @securityinaction1018
      @securityinaction1018  8 หลายเดือนก่อน

      If it is fine, please share the curl command. Make sure client ID and client secret is not exposed in public comments.

  • @harshats1
    @harshats1 5 หลายเดือนก่อน

    how to change "exp" jwt claim in azure entra ID

    • @securityinaction1018
      @securityinaction1018  5 หลายเดือนก่อน

      You can try changing the token lifetime as mentioned here learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes and that should change the exp claim accordingly. I have not tried that. But, I think it should work.
      Please like, subscribe & share!! Thanks in advance.

  • @johannesmarais2755
    @johannesmarais2755 4 หลายเดือนก่อน

    Great video. I am getting the following exception when adding the issues found in the token: "Caused by: java.lang.IllegalArgumentException: Unable to resolve the Configuration with the provided Issuer of: registeredDomain/{tenantId}/v2.0/"

    • @securityinaction1018
      @securityinaction1018  4 หลายเดือนก่อน

      It looks like a wrong issuer. registeredDomain/{tenantId} are placeholders. You need to replace that with the actual values.
      Please like, subscribe & share this video / channel !! Thanks in advance.