dboehm/pluralsight

The version of NekoShlink used in the PluralSight course on Securing REST Services Using Spring Security 5

NekoShlink for PluralSight

This repository contains the code for the PluralSight course as it is developed along the various modules of the course.

The course is written and presented in Kotlin, but Java developers can also find the Java version of the relevant code in this repo.

Original Kotlin Code

All the Kotlin code is for the course is in the kotlin branch, and each demo of the course is labeled with a tag, as follows

• Manually Securing a CLI Application
  • module2start Getting Familiar with unsecured NekoShlink
  • module2step1 Securing the CLI with API keys and hard-coded userbase
• Adding Authentication to a RESTful API with Spring Security and Spring Boot
  • module3step1 Securing the Shlink Compatibility API with API keys
  • module3step2 Enabling TLS in a Spring Boot application
  • module3step3 Enabling mTLS in a Spring Boot application
  • module3step4 Opening up access to the Open API endpoints
• Creating and Maintaining a User Base for your RESTful API
  • module4step1 X.509 certificates with hard-coded userbase
  • module4step2 Configuring the HTTP Basic and Form-based challenges
• Implementing OIDC Authentication with KeyCloak
  • module5step1 OIDC authentication with Spring Auth Server
  • module5step2 OIDC authentication with KeyCloak
  • module5step3 Example third-party NekoShlink dashboard with KeyCloak
• Adding Authorization to the RESTful API Endpoints
  • module6step1 Configuring fine-grained authorization for HTTP endpoints
  • module6step2 Simplifying authorization expressions with role hierarchies
• Adding Authorization to the Business Logic Services
  • module7step1 Method-level authorization for HTTP endpoints
  • module7step2 Method-level authorization on data access layer
  • module7step3 Access control annotations and no more controls in front-ends
  • module7step4 Delegation with RunAs (solving access issues in anonymous code)
• Auditing Access to the Application
  • module8step1 Authentication logging with Spring Security events
  • module8step2 Spring Actuator audit events
  • module8step3 JPA callbacks and Spring Data auditing
  • module8step4v1 Setting up historic data change audit (with Envers)
  • module8step4v2 Setting up historic data change audit (with JaVers)

Java Code Version

Java code is provided for all relevant artefacts to the course in the java branch, and each demo of the course is labeled with a tag, as follows

• Manually Securing a CLI Application
  • javamod2start Getting Familiar with unsecured NekoShlink
  • javamod2step1 Securing the CLI with API keys and hard-coded userbase
• Adding Authentication to a RESTful API with Spring Security and Spring Boot
  • javamod3step1 Securing the Shlink Compatibility API with API keys
  • javamod3step2 Enabling TLS in a Spring Boot application
  • javamod3step3 Enabling mTLS in a Spring Boot application
  • javamod3step4 Opening up access to the Open API endpoints
• Creating and Maintaining a User Base for your RESTful API
  • javamod4step1 X.509 certificates with hard-coded userbase
  • javamod4step2 Configuring the HTTP Basic and Form-based challenges
• Implementing OIDC Authentication with KeyCloak
  • javamod5step1 OIDC authentication with Spring Auth Server
  • javamod5step2 OIDC authentication with KeyCloak
  • javamod5step3 Example third-party NekoShlink dashboard with KeyCloak
• Adding Authorization to the RESTful API Endpoints
  • javamod6step1 Configuring fine-grained authorization for HTTP endpoints
  • javamod6step2 Simplifying authorization expressions with role hierarchies
• Adding Authorization to the Business Logic Services
  • javamod7step1 Method-level authorization for HTTP endpoints
  • javamod7step2 Method-level authorization on data access layer
  • javamod7step3 Access control annotations and no more controls in front-ends
  • javamod7step4 Delegation with RunAs (solving access issues in anonymous code)
• Auditing Access to the Application
  • javamod8step1 Authentication logging with Spring Security events
  • javamod8step2 Spring Actuator audit events
  • javamod8step3 JPA callbacks and Spring Data auditing
  • javamod8step4v1 Setting up historic data change audit (with Envers)
  • javamod8step4v2 Setting up historic data change audit (with JaVers)