I have the below microservice architecture(spring boot ,java). I want to implement OAUTH2 JWT security at ZUUL gateway only and not replicate the security code in microservices .
let say Microservice 1 has rest end point http://localhost:8080/microservice-1/get/person then i should not have any security code in Microservice 1 but still at the same time no one should be able to access the Microservice 1 rest end point directly without passing JWT tokens but it should only be accessible via ZUUL.
You can use WebSecurityConfigurerAdapter class in your Zuul gateway and configure the security for each route.
This is an excellent example for you
https://medium.com/#bharatrajmeriyala/spring-cloud-security-with-netflix-zuul-2ef04a1dcfb
Related
I have multiple Spring boot micro-services deployed to kubernetes. Im also using Spring Gateway & Eureka Discovery.
Those micro-services are secured with Spring Security and require JWT token for access to the endpoints. Im using #PreAuthorize methods etc.
It all works fine when I'm accessing those endpoints from frontend application that is sending JWT token in request,
but, I can't bypass that security in service-to-service communication via FeignClient.
Ideally, my micro-services wouldn't need token at all to call other micro-service's methods via FeignClient. But I still need that security when endpoints are accessed from frontend or when requests are coming from Spring Api Gateway.
Do you know some elegant solution to this problem?
I was thinking about adding another pair of endpoints that don't have security annotations (#PreAuthorize) and somehow disable access to those endpoints on Spring Api Gateway, so they cannot be accessed from outside, but only directlly by one of the micro-services.
I need some understanding on over all flow of spring security.
I have implemented oauth2 Authorization Server and a Resource server in the same Spring Boot App.Where i am able to generate JWT tokens. And sample Rest api in this app is secured and accessible only with token.
I have another spring boot app which should be secured? What should i do in this. Also i need to read the token in this service to know the role of user.
Please clarify me how to implement the step2.
You can create a module where your spring security config is implemented.
In this module is the class that is annotated with the #EnableWebSecurity annotation, where you define the open routes. I guess you already have a class like this for your sample rest API, mentioned in step 1.
Now every microseconds that has to be secured uses this module by importing it, eg as maven dependency. By this it's api is automatically secured via spring security.
Your auth service serves a jwk endpoint where every microservice can verify a token via public key.
microservices architecture
I have a micro service(userservice:user related microservice) but in Zuul API gateway application i want to authenticate requests for all microservices and use spring security. I have to create signin and signup requests(AuthController) in Zuul application which require datasources,userRepository all things in zuul application.
If i use userservice(microservice user related)for other user related requests then i have use same datasource and create duplicate beans and repository for same data source which i already created in zuul api gateway application ?
I don't feel it would be a good design to authenticate usenames and passwords at gateway level. Instead what you can do is, you can add JWT tokens which can validate the request itself in zuul filters. This can be one level of verification at gateway level.
Second, you can implement caching at api level which would significantly increase the throughput of your backend security api.
I have a springboot application with 4 microservices, eureka server and a centralised API gateway. I have performed authentication using jwt token at api gateway and now i want to implement role based security on methods which are present in microservices other than gateway. I have tried to use #PreAuthorize but its not working out of the gateway. Is there any solution to achieve this type of security ?
First Question :
Spring Security OAuth2 Implemented in a single project having Authorization and Resource Server, getting access token on postman successfully, I already have implemented zuul as a seperate microservice and able to access different different microservice with the same port number. But What I am trying to implement, How will I Make use of Zuul Proxy in context to Spring Security OAuth2 ? How will I integrate Zuul Proxy with Spring Securtity OAuth2 ?
Second Question :
How to create a custom controller in Spring Security OAuth2 ? Please give your valuable suggestions ? Thanks in Advance