Issue
Can you suggest which Spring Security should I use to secure a real world Spring Boot Application, say for example banking application, where no social media login is used?
Solution
Well, Bcrypt means you gonna have your own user database, which is a completely different thing from an external IdP. You'll have to take care of user registration, self-service, MFA and many other things.
External IdPs are more or less similar, one word though... If you are hosting your app inside one of big clouds, then check if you can harness their user pools (for AWS it's Cognito, as an example). From one perspective it makes you vendor locked, but opens other doors for using their internal services with a proper IAM in mind.
If you go with a completely external one, then they all should be pretty similar functionality-wise. Okta, Auth0 are some which I had experience with, but doesn't mean there are no other ones.
As for a protocol, no preference, though OIDC is pretty well supported by vendors and third parties. SAML sometimes is considered bit outdated, though is completely reliable and bullet proof. If your app will be calling some other services, then OIDC seems more natural way to go, as you will have to go with OAuth (I suppose) to call external providers.
Bottom line: decide if you are up to taking all the burden, mentioned in the first paragraph, onto your shoulders. If no desire -> go with an external one (I'd recommend that, but you'll have to pay for that, of course).
Answered By - Philipp Grigoryev
Answer Checked By - Marie Seifert (JavaFixing Admin)
