Okta Spring Boot Starter VS jjwt

Okta also now has an Okta Spring Boot starter. I didn't use it in my first experiment, but I'm a big fan of it after the last few years! It dramatically simplifies configuration and makes securing your apps with OAuth 2.0 and OIDC easy. It's a thin wrapper around Spring Security's resource server, OAuth client, and OIDC features. Not only that, but it works with Okta Workforce Identity, Okta Customer Identity (aka Auth0), and even Keycloak.

looks like these, the api, sdk, and the httpclient are basically what the okta saml spring boot starter are wrapping (https://github.com/okta/okta-spring-boot/blob/master/okta-spring-boot-starter/pom.xml). so you should be able to call those directly.

okta: Okta Spring Boot Starter that helps OAuth 2.0 and OIDC configuration

If you'd rather use Auth0, that's possible too! First, you'll need to use the Spring Security dependencies as mentioned above. The Okta Spring Boot starter currently doesn't work with Auth0.

How does this compare to JJWT?

Note that this PoC uses DER signature which is accepted by the jjwt library as fallback (see https://github.com/jwtk/jjwt/blob/master/impl/src/main/java/io/jsonwebtoken/impl/crypto/EllipticCurveSignatureValidator.java ), but that is not a standard. Standard is JOSE format.

There are many open-source JWT implementations available for all languages. In this blog post, we use Java jjwt library in this blog post.