# How we Integrated SPIFFE, Oauth2.0 and Spring Boot

DevFeed: [How we Integrated SPIFFE, Oauth2.0 and Spring Boot](<https://devfeed.tech/articles/how-we-integrated-spiffe-oauth2-0-and-spring-boot-15454.md>)

Original publisher: [Read original article](<https://medium.com/wise-engineering/how-we-integrated-spiffe-oauth2-0-and-spring-boot-39a6faf41f96?source=rss----f2565bbe9c46---4>)

Author: Matthew Benedict Stocks

Published: 2022-12-14T09:36:48Z

Content type: tutorial

Language: en

Sources: [Wise Engineering - Medium](<https://devfeed.tech/sources/wise-engineering-medium.md>)

Topics: [SPIFFE](<https://devfeed.tech/topics/spiffe.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [SPIRE](<https://devfeed.tech/topics/spire.md>), [Library](<https://devfeed.tech/topics/library.md>), [Security](<https://devfeed.tech/topics/security.md>), [Spring Boot](<https://devfeed.tech/topics/spring-boot.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [library](<https://devfeed.tech/tags/library.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [platform](<https://devfeed.tech/tags/platform.md>), [security](<https://devfeed.tech/tags/security.md>), [service-mesh](<https://devfeed.tech/tags/service-mesh.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spring-boot](<https://devfeed.tech/tags/spring-boot.md>)

## AI overview

Wise's Security Engineering team describes how it consolidated SPIFFE/SPIRE and OIDC authorization strategies into the wise-security shared library. The approach reduces Spring Security boilerplate, presents a consistent service-layer security context, and adds guardrails intended to reduce misconfiguration and authorization complexity.

## Source excerpt

How we Integrated SPIFFE, OAuth2 and Spring Boot At Wise the Security Engineering team supports the Security Squad by developing tools and building technical controls relevant to the security maturity of existing technological setup. We work closely with teams across Platform and Product to help improve our overall security posture and reduce the friction encountered when engineering new software at speed. Photo by Jason Dent on UnsplashThe problem As a company we have a goal of reducing the amount of time it takes to go from inception to creation with our services. We want teams across Wise to be able to focus on the challenges encountered in their domain, rather than cross-cutting concerns, such as how to secure their endpoints. At Wise our approach was to create a common shared library, allowing teams to share our security solution while still retaining their autonomy. Standard security setups such as those seen with Spring Security often require a lot of boilerplate code (even if provided as part of a service template) which we wanted to reduce and where possible, abstract it entirely. Along with improving the quality of life for new and experienced engineers within Wise, this also helps to prevent any misconfiguration that could eventually lead to a vulnerability. Another challenge which arose was to offer a security context that appears the same at the service layer, but can be created from any of the protocols used by our systems, as well as being extensible if necessary. We needed to allow developers to control access to services with minimal effort, alongside creating a security guardrail for exposed endpoints to ensure services have been configured correctly. Introducing Wise Security At Wise, our service mesh layer is handled by Envoy and the identity framework for secure communication between mesh nodes is SPIFFE/SPIRE. User based IAM is handled via the OIDC authorization protocol. Each authorization approach must be enforced at the service layer, but du