Building a self-hosted IAM in Spring Boot: OAuth2, OIDC, and production deployment lessons

Short summary

A developer built a self-hosted IAM service in Spring Boot supporting form login, Google OIDC, and GitHub OAuth2 with a unified user model and data-driven RBAC. The key lesson: OAuth2 and OIDC behave differently in production — GitHub requires an extra /user/emails call while Google returns claims in a signed JWT. Behind a reverse proxy, OAuth2 redirect URIs silently break unless you set server.forward-headers-strategy=framework to trust X-Forwarded headers.

• •OAuth2 (GitHub) and OIDC (Google) require different handling despite Spring Security's unified API
• •Reverse proxies break OAuth2 redirect URIs — fix with server.forward-headers-strategy=framework
• •Centralize user provisioning in one function to avoid drift across auth paths

Generated with AI, which can make mistakes.