Skip to content
Yassir Halaoui
FR
Lire en français

Competence

API security and enterprise integration: OAuth 2.0, mTLS, SOAP

Half of enterprise engineering is talking safely to somebody else's system: a card processor over SOAP, a bank's single sign-on, an API gateway, a payment provider's webhooks. That's the half I specialise in.

In short

Yassir Halaoui builds secure integrations for regulated systems: OAuth 2.0 and OpenID Connect with Okta, JWT, role-based access control, mutual TLS and WS-Security over SOAP, API gateways such as Apigee and Azure API Management, and webhooks. At Pluxee he ingests files encrypted by a hardware security module over SOAP, secured with mTLS and WS-Security.

Where I've used it

  1. Pluxee · 2025 to now

    Ingests files encrypted by a card processor's hardware security module over SOAP with mutual TLS and WS-Security, processed asynchronously and idempotently from webhook notifications.

  2. Société Générale · 2022 to 2024

    Integrated the bank's single sign-on and identity management for authentication and user administration, and designed fine-grained roles, permissions and constraints within the bank's secure-by-design process.

  3. CIH Bank · 2017 to 2022

    Designed an ATM cash-deposit API with the vendor, wrote the API design contract, and exposed the service through an API gateway that secured the REST calls.

  4. Consulting · 2022

    Worked with Apigee as the API gateway of an automotive rental platform.

  5. Kempt, RevealTogether, TheQuizMaster

    Stripe payments and webhooks in all three products, including licence keys issued by a Stripe webhook for Kempt.

Everything in this area

Identity and access
  • OAuth 2.0
  • OpenID Connect
  • Okta
  • JWT
  • RBAC
  • SSO
Transport and message security
  • mTLS
  • WS-Security
  • SOAP
  • XML signature
Gateways and contracts
  • Apigee
  • Azure API Management
  • OpenAPI
  • BFF
  • REST
Payments and webhooks
  • Stripe
  • PayPal
  • Webhooks
  • Salesforce sync
Practice
  • Secure by Design
  • Idempotency
  • Keyset pagination

In depth

Three layers people confuse

Mutual TLS proves which machine is calling. WS-Security proves who sent a message and that nobody changed it on the way. Payload encryption keeps a file sealed until it reaches the one component holding the key. A partner asking for all three isn't being redundant.

A valid token isn't permission

The finding I see most in reviews: an endpoint that checks the token and never checks whether this user may touch this record. A role check says what kind of user you are. An ownership check says whether this account is yours. You need both, on every endpoint that takes an id.

Webhooks are a delivery guarantee

Return 200 only after the event is safely stored, and a 5xx when it isn't, so the sender retries. A defensive catch-all that always answers 200 quietly throws away the sender's retries, and your data with them.

Questions

Can you integrate a SOAP web service with mTLS and WS-Security in Spring Boot?

Yes, I run one in production. On Spring Boot 3 it means HttpClient 5 with separate key and trust stores for mTLS, WSS4J interceptors for signing and timestamps, and a webhook handler that records and returns before doing any work.

OAuth client credentials or mTLS between services?

Regulated counterparties usually want both: mTLS on the connection so a leaked token is useless on its own, and a short-lived scoped token in the request for authorization. On their own, each leaves a gap.

Can you set up Spring Security with OIDC and Okta?

Yes: a stateless resource server that denies by default, validates issuer, expiry and audience, maps claims to roles, and checks ownership in the service rather than only at the gateway.

Do you handle mTLS certificate rotation?

Yes. Separate the trust store from the key store, trust both chains during an overlap of weeks, rotate one direction at a time, and alert on the certificate actually presented on the wire.

Field notes

Shipped work

Related competences