AUTHENTICATION SERVER

I built a production-ready, highly secure multi-tenant backend that serves as the single source of truth for enterprise applications. It’s designed to handle strict data isolation, custom security flows and clean code practices out of the box.

Why?

• Built with Hibernate 6 multi-tenancy, meaning one can scale to multiple clients efficiently without spinning up separate database instances for everyone.
• Implements modern OAuth2 standards with custom JWT claims and a public JWKS endpoint so the microservices or client applications can easily and securely validate user tokens.
• Uses a custom shared library for reusable domains, properties and utils, which cuts down on boilerplate code and speeds up future feature rollouts.
• Every database update is tracked, tested and deployed safely using Liquibase, preventing nasty production migration bugs.

Key Features

• Used Hibernate 6's @TenantId paired with a custom OncePerRequestFilter to automatically catch tenant headers on incoming requests and route data to the right place.
• Configured io.jsonwebtoken to issue tokens with modified, business-specific claims and exposed a secure /.well-known/jwks.json endpoint for seamless token validation.
• Built a flexible authorization layer(RBAC) to ensure users only access the endpoints and data they’re allowed to.
• Integrated my own custom shared-library to keep core domains, utilities and properties DRY (Don't Repeat Yourself) across projects/services.
• Configured MySQL alongside Liquibase to keep database schemas version-controlled and synchronized effortlessly.

Technology Stack

• Database: MySQL
• Migration Tool: Liquibase
• Dependencies:
  • spring-boot-starter-web
  • spring-boot-starter-data-jpa
  • spring-boot-starter-validation
  • Security:
    • spring-boot-starter-security
    • spring-boot-starter-oauth2-client
    • io.jsonwebtoken (jjwt-api, jjwt-impl, jjwt-jackson)
  • mysql-connector-j
  • liquibase-core
• Shared Infrastructure: shared-service (Internal dependency for re-usable domains, global exception handling, and custom validation groups)