AUTHENTICATION One question: “Who are you?” · 9 ways to answer it 1 Form login Browser apps, your Auth Server Please sign in Username Password Sign in Users DB password hash Filter UsernamePasswordAuthentication… Spring formLogin() 2 HTTP Basic Simple internal APIs, tools Every request GET /reports Authorization: Basic bml0aGluOnB3 base64(user:pass) Users DB checked each call Filter BasicAuthenticationFilter Spring httpBasic() 3 Session cookie Remembers a form login Next request GET /account Cookie: JSESSIONID=8F2A no password again Session store server-side Filter SecurityContextHolderFilter Spring sessions (default) 4 JWT Bearer token APIs, microservices (your A, B) API call POST /payments Authorization: Bearer eyJhbGci… signed by Auth Server Public key verify signature Filter BearerTokenAuthentication… Spring oauth2ResourceServer() 5 OAuth2 / OIDC login “Log in with IDHub” ShopEasy Sign up / Log in Log in with IDHub → ID token (JWT) IDHub login provider Filter OAuth2LoginAuthentication… Spring oauth2Login() 6 Client credentials Jobs, service-to-service Token request POST /oauth2/token client_id: settlement-job + client_secret Auth Server checks the app Filter OAuth2ClientAuthentication… Spring RegisteredClient 7 API key Partner integrations Partner call GET /rates X-API-Key: pk_live_7Hq… no user, no expiry Key store lookup key Filter OncePerRequestFilter (yours) Spring custom filter 8 mTLS / X.509 cert Bank-to-bank, high security TLS handshake Client certificate: CN=partner-bank issued by trusted CA private key proven Trust store trusted CAs Filter X509AuthenticationFilter Spring x509() 9 MFA / OTP / Passkey Second factor, passwordless Verify it’s you Code sent to phone: 6-digit code Verify Factor check OTP or device key Filter OneTimeToken / WebAuthn Spring webAuthn(), 7.x MFA ALL 9 END IN THE SAME PIPELINE Only the credential and the filter change; the rest of Spring Security is identical. Credential one of the 9 above Auth filter reads it from request AuthenticationManager “who can check this?” Provider Dao / Jwt / Oidc / X509 SecurityContext who = nithin 1 2 3 4 401 Unauthorized wrong / missing fails AUTHORIZATION next: what may they do? Remember it as: Credential → Filter → Manager → Provider → Context Fail = 401. Pass = Authorization decides (403 if not allowed). Spring Security · Security in Pictures · poster 1 of the series Sample poster. Pinch to zoom on a phone. Next posters in the same format: Authorization, OAuth 2.0, JWT, Tokens.