This blog dives into integrating Auth0 as an identity provider for your Spring Boot API, covering key concepts like authentication vs. authorization, configuring Spring Security, and validating JWT tokens. Learn how to set up your Auth0 account, configure security settings, and create public and protected API endpoints. The guide also includes tips on using Springdoc OpenAPI UI for testing and debugging with Auth0 tokens. By the end, you’ll have a secure API leveraging third-party authentication with robust token validation for enhanced security and scalability.

Using Auth0 as an Identity Provider in Spring Boot API

As a Java developer, my biggest gripe has always been speed.
To be more specific, startup speed. Starting up a Java application with all Its JVM glory can take up to 10–15 seconds in a heavier application. In this day and age where the attention span of a user can be measured in mere 7–8 seconds, this can be problematic. Imagine waiting 10–12 seconds for your favorite Twitter user’s page to load.
 
Scaling Java applications can be tricky (and pricy!) in the cloud due to the nature of the ‘write once — run anywhere’ paradigm. But what if we could eliminate this cold boot issue? What if we could optimise the price we pay for our cloud infrastructure?
/.../
<h1 style="text-align: center">Introducing GraalVM native images and Quarkus</h1>
 
<h3>What is GraalVM, and what are native images?</h3>
<a href="https://www.graalvm.org/" rel="noopener ugc nofollow" target="_blank">GraalVM</a> is a high-performance JDK distribution. It is designed to accelerate the execution of applications written in Java and other JVM languages while also providing runtimes for JavaScript, Ruby, Python, and a number of other popular languages. It heavily relies on compiler optimisation techniques, such as an <a href="https://www.graalvm.org/java/advantages/#accelerating-java-performance" rel="noopener ugc nofollow" target="_blank">aggressive and sophisticated inlining technique</a>.
 
With GraalVM you can compile Java bytecode into a platform-specific, self-contained, native executable to achieve faster startup and smaller footprint for your application. It is using an AOT (ahead-of-time) compiler instead of a JIT one that we are used to.
 
Ahead-of-time compiled applications use only a fraction of the resources required by the JVM which means they cost less to run and improve utilisation. This means that although your application might consume significantly less memory and start up faster, you might have to wait a bit more for your compilation to complete.
 
<blockquote style="text-align: center">Smaller memory footprint means that our cloud infrastructure can run on cheaper, smaller instances than we would normally run them in JVM mode.</blockquote>
 
Natively compiled applications also can benefit from starting up from a pre-booted memory snapshot. That means that frameworks that fully support native image compilation can leverage it to create configuration at compile time instead of taking time configuring your application at startup. 
The image below shows memory usage and execution times in native mode.&nbsp;
<img src="https://res.cloudinary.com/bishop-co/image/upload/v1727877352/Blog/Java_start_up_time_pmw3xm.webp" width="1400" height="541" />
<a href="https://www.graalvm.org/native-image/" rel="noopener ugc nofollow" target="_blank">https://www.graalvm.org/native-image/</a>
 
There are several frameworks, such as Quarkus, Micronaut that fully support native image compilation. At the time of writing this article, the Spring team is still a little behind in fully supporting it, <a href="https://spring.io/blog/2021/03/11/announcing-spring-native-beta" rel="noopener ugc nofollow" target="_blank">but support is on its way</a>! 

It’s not all fun and games with native images. We lose a lot of convenience features that the JVM provides, such as profiling and remote debugging. 
Garbage collection is thankfully <a href="https://www.graalvm.org/22.1/reference-manual/native-image/MemoryManagement/" rel="noopener ugc nofollow" target="_blank">still an option</a> in native mode tho!
 
<h3>How to install GraalVM and native image extension</h3>
You can install GraalVM on your machine in several ways.
<ul>
 <li>You can download the official releases from their <a href="https://github.com/graalvm/graalvm-ce-builds/releases" rel="noopener ugc nofollow" target="_blank">GitHub</a> page. They support several platforms (including Apple Silicon!) and two versions of Java. After that, you can follow <a href="https://www.graalvm.org/22.1/docs/getting-started/#install-graalvm" rel="noopener ugc nofollow" target="_blank">this guide</a> for your respective platform.</li>
 <li>Another option if you have a UNIX-like system, like Linux or MacOS, is to use SDKMan to manage your installed SKDs. It’s a great tool to manage multiple java installations and switch between them with ease. Think of this tool as <a href="https://github.com/nvm-sh/nvm" rel="noopener ugc nofollow" target="_blank">NVM</a> for Java. Follow <a href="https://sdkman.io/" rel="noopener ugc nofollow" target="_blank">this link</a> to learn more about SDKMan and about how to install it.</li>
</ul>
 
<h1 style="text-align: center">The Quarkus framework</h1>
 
<h3>What is Quarkus?</h3>
A Kubernetes Native Java stack tailored for OpenJDK HotSpot and GraalVM, crafted from the best-of-breed Java libraries and standards. It encapsulates a load of features that makes it really cool to develop with it.
<ul>
 <li>Container First: Quarkus tailors your application for GraalVM and HotSpot. Amazingly fast boot time, incredibly low RSS memory (not just heap size!) offering near-instant scale-up and high-density memory utilization in container orchestration platforms like Kubernetes. They use a technique we call compile time boot, which is leveraged by using GraalVM’s native image module.</li>
 <li>Unifies imperative and reactive approaches: Combine both the familiar imperative code and the reactive style when developing applications.</li>
 <li>Community and Standards: Quarkus provides a cohesive, fun-to-use, full-stack framework by leveraging a growing list of over fifty best-of-breed libraries that you love and use. All are wired on a standard backbone.</li>
 <li>Kube-Native: The combination of Quarkus and Kubernetes provides an ideal environment for creating scalable, fast, and lightweight applications. Quarkus significantly increases developer productivity with tooling, pre-built integrations, application services, and more.</li>
 <li>Developer Joy: A cohesive platform for optimized developer joy with unified configuration and no-hassle native executable generation. Zero config, live reload in the blink of an eye. It also has integrated support for <a href="https://www.testcontainers.org/" rel="noopener ugc nofollow" target="_blank">Testcontainers</a>, which starts up relevant containers for you during development.</li>
</ul>
Quarkus also offers amazing performance both with GraalVM JVM and native image mode as well. The image below shows memory usage and time-to-first response graphs both in JVM and native mode.
<img src="https://res.cloudinary.com/bishop-co/image/upload/v1727877352/Blog/memory_usage_k38q2u.webp" width="1400" height="644" />
<a href="https://quarkus.io/" rel="noopener ugc nofollow" target="_blank">https://quarkus.io</a>
 
<h3>A simple Quarkus application</h3>
Getting started with Quarkus is a similar experience to using SpringBoot. It has a similar process of creating a new application from scratch. Let’s create a simple application with a REST controller which we can compile to native later!
 
The first step is to visit <a href="https://code.quarkus.io/" rel="noopener ugc nofollow" target="_blank">https://code.quarkus.io</a> . This page presents us with a similar interface to <a href="https://start.spring.io/" rel="noopener ugc nofollow" target="_blank">https://start.spring.io</a>. You can select your desired build tool and java version. There is also a Kotlin extension if that what's floats your boat. For now, the default configuration is fine for us.
 
Select <code>RESTEasy Reactive</code> and <code>RESTEasy Reactive Jackson</code>` extensions and click Generate your application. This should create and download a zip package with our generated source code.
Unzip, navigate to the folder and issue the <code>./mvnw compile quarkus:dev</code> command to start our application on development mode with live reload. Let's visit <a href="http://localhost:8080/hello]and" rel="noopener ugc nofollow" target="_blank">http://localhost:8080/hello</a> and make sure it works.
 
You might have noticed it almost took a second for the application to start up in JVM mode under GraalVM. This is unacceptable 😤. Let’s compile it into a native imageQuarkus JVM startup time.
<img src="https://res.cloudinary.com/bishop-co/image/upload/v1727877352/Blog/Quarkus_JVM_startup_time._ajpodp.webp" width="1400" height="219" />
Quarkus JVM startup time.
<h3>Compiling to native</h3>
You have two ways of compiling into native images.
<ul>
 <li>If you have installed GraalVM and the native image extension, you can run the following command to compile a native image: <code>./mvnw package -Pnative</code></li>
 <li>If you have not installed it on your own machine, you also have the option to use a D<a href="https://www.docker.com/" rel="noopener ugc nofollow" target="_blank">ocker</a> container that has GraalVM and the native image extension installed by default. You can use the following command for that: <code>./mvnw package -Pnative -Dquarkus.native.container-build=true</code></li>
</ul>
It might take some time to finish compilation, especially in the docker container, but after a while you should have a native executable named <code>code-with-quarkus-1.0.0.-SNAPSHOT-runner</code> in your target folder.
 
<blockquote style="text-align: center">Now it started up in a matter of a couple a milliseconds. Nice!</blockquote>
 
<img src="https://res.cloudinary.com/bishop-co/image/upload/v1727877352/Blog/Quarkus_native_startup_time_hh9yhc.webp" width="1400" height="172" />
Quarkus native startup time
/.../
<h1 style="text-align: center">Final thoughts</h1>
So there you have it. Now you can compile Quarkus applications into native images. Hopefully, this article was a helpful intro to native images and Quarkus!
If you find this helpful, share it, so others could learn from it as well!

Struggling with slow Java app startups? In this guide, I’ll show you how GraalVM and Quarkus can help. GraalVM compiles Java into fast native executables, while Quarkus optimizes for scalability. I’ll walk you through setting up GraalVM and building a Quarkus app into a native image!

Latest posts - Technology