Skip to content
nanohypenanohype

Spring Security Auth Module

Drop-in Spring Security module for a Spring Boot service. Configures a multi-provider SecurityFilterChain supporting OAuth 2.0 JWT resource server (OIDC), header-based API keys with a pluggable validator, and opaque-token introspection — all selectable via @ConfigurationProperties, composable simultaneously, dispatching through Spring Security's native AuthenticationManager. Includes a custom JWT claim-to-authority converter, optional @EnableMethodSecurity configuration, and a test stub for bypassing real token validation in slice and integration tests.

Namemodule-spring-security
Version0.1.0
Categorycomposable-modules
LicenseApache-2.0
Personaengineering
Tagsjava, spring, spring-security, oauth2, oidc, jwt, api-key, identity, auth
Sourcetemplates/module-spring-security

Render it

Three front doors, one catalog. Pick whichever suits the caller.

# CLI
npx @nanohype/sdk render module-spring-security --out ./my-app

# SDK
import { LocalSource, renderTemplate } from "@nanohype/sdk";
const result = await renderTemplate(source, "module-spring-security", variables);

# MCP — from an agent
get_template({ name: "module-spring-security" })

Prerequisites

ToolVersionWhy
java>=25JDK 25 (latest LTS) for compiling the security module
mvn>=3.8Maven build tool for dependency resolution

Variables

Required

ProjectName string
Kebab-case project name, used in bean names and log identifiers Must be lowercase kebab-case starting with a letter.
JavaPackage string
Root Java package (dot form) of the consuming project Must be a valid Java package (e.g. com.example.app).
PackageDir string
Root Java package as a directory path (slash form). Must be the slash-form of JavaPackage — e.g. if JavaPackage is 'com.example.app' then PackageDir is 'com/example/app'. Must be lowercase segments separated by slashes.

Optional

OidcIssuer string — defaults to https://auth.example.com
Default OIDC issuer URL baked into application.yaml documentation. Override at runtime via the SECURITY_JWT_ISSUER_URI env var.
AllowedAudience string — defaults to ${ProjectName}
Default JWT `aud` claim value expected on inbound tokens
IncludeMethodSecurity bool — defaults to true
Enable @PreAuthorize / @PostAuthorize via a MethodSecurityConfig
IncludeTests bool — defaults to true
Include test helpers (stub JwtDecoder, filter-chain assertions)

What it produces

12 files. Placeholder names such as __APP_NAME__ are what the renderer substitutes into.

README.md
src/main/java/__PKG_DIR__/security/ApiKeyAuthenticationFilter.java
src/main/java/__PKG_DIR__/security/ApiKeyAuthenticationProvider.java
src/main/java/__PKG_DIR__/security/ApiKeyAuthenticationToken.java
src/main/java/__PKG_DIR__/security/ApiKeyValidator.java
src/main/java/__PKG_DIR__/security/InMemoryApiKeyValidator.java
src/main/java/__PKG_DIR__/security/JwtAuthoritiesConverter.java
src/main/java/__PKG_DIR__/security/MethodSecurityConfig.java
src/main/java/__PKG_DIR__/security/SecurityConfig.java
src/main/java/__PKG_DIR__/security/SecurityProperties.java
src/test/java/__PKG_DIR__/security/SecurityConfigTest.java
src/test/java/__PKG_DIR__/security/TestSecurityConfig.java

Composes with

Composites that use it

  • Identity-Aware Spring Boot Microservice — Spring Boot 4 microservice on JDK 25 with identity enforced at both the service-mesh edge (Istio RequestAuthentication + AuthorizationPolicy) and the application boundary (Spring Security OAuth 2.0 resource server) — defense in depth against the same OIDC issuer.
  • Spring Boot Microservice — Java Spring Boot 4 HTTP service on JDK 25 with a Kubernetes deployment and an optional Grafana + Prometheus + Loki observability stack.