Brief
Full-stack migration of Credit Suisse's central Identity & Access Management system (15 applications, a central job processing system, and over 5 million lines of code) to Java 21, Spring Boot 3.4, and Docker on OpenShift.
15 applications. 5 million lines of code. Time for a proper Spring cleaning.
Credit-Suisse - AURA
Technology
Java 21, Spring 6.3, Spring Boot 3.4, Jakarta Faces, JoinFaces, Spring Security 6.3, OAuth2, Docker, OpenShift / Kubernetes, Jenkins, Maven.
Legacy JavaServer Faces 2.0 applications were migrated to Jakarta Faces with JoinFaces, while CDI and Apache DeltaSpike were replaced by Spring. WebLogic servers were retired in favor of embedded Tomcat on OpenShift.
15
applications migrated
5M+
lines of code
8 months
March to November 2024
Starting Point
AURA is the central Identity & Access Management system of Credit Suisse: the backbone of access control for thousands of employees across the globe.
By 2024, AURA had grown to over 15 applications and components, a central job processing system, more than 5 million lines of code, and 1,000+ UI screens. A business-critical system at enormous scale.
Under the hood: Java 8, Spring 4.x, JavaServer Faces 2.0, AngularJS, and WebLogic application servers. A stack that had served its purpose well, but with these tools all past their end-of-life, the time had come to move to a modern, supported foundation. Irian got the call.
Development
Migrating a live, business-critical IAM system is not a find-and-replace exercise. It demands deep architectural understanding, and a team that thrives on complexity.
We started by unifying the Maven build and dependency structure across all core libraries, then systematically upgraded every component in the Spring and Spring Boot ecosystem to the latest versions. JavaServer Faces 2.0 gave way to Jakarta Faces with JoinFaces. CDI and Apache DeltaSpike were replaced with Spring. The security architecture was rebuilt from the ground up: Spring Security 6.3 with OAuth2 login, in addition to the existing certificate-based authentication.
Deployment infrastructure was migrated from proprietary WebLogic rollout systems to Docker containers on OpenShift / Kubernetes, including load balancer configuration, Jenkins CI/CD integration, and acceptance testing across all environments using an Agile Scrum approach.
Result
In November 2024, AURA went live on the new stack, on schedule, across all 15 applications, with the first production deployment landing exactly as planned.
Eight months. Fifteen applications. Five million lines of code. Java 21, Spring Boot 3.4, Jakarta Faces, OAuth2, and OpenShift, all running in production. No lingering legacy. No extended post-launch fire-fighting.
The migration modernized the stack and laid the foundation for Credit Suisse's IAM to evolve: faster delivery cycles, a homogeneous codebase, improved security posture, and a deployment pipeline ready for the next decade. Irian provided operational support after go-live, ensuring a stable handoff.
Feeling inspired?
More Projects
Oesterreichische Kontrollbank - ADAS3
Greenfield rebuild of Austria's sovereign bond auction platform which manages EUR 315 billion in federal debt.
Credit-Suisse - AURA Runtime
Modernization of Credit Suisse's central IAM authorization backend, from monolith to microservices on OpenShift, handling 10M+ requests per day across 4 global regions.
UBS - Client Access Manager
Migration of a mission-critical client access management platform from Credit Suisse to UBS Azure cloud infrastructure.