Skip to content

Latest commit

 

History

History
82 lines (62 loc) · 7.1 KB

spring-cloud-gateway.md

File metadata and controls

82 lines (62 loc) · 7.1 KB

1. About

This section will demonstrate this scenario:

image

  1. Client get access token from Microsoft Entra ID
  2. Client use the access token to access Gateway.
  3. Gateway validate the access token. If the access token is valid, use the access token to access the ResourceServer. There are 2 ResourceServers, which ResourceServer to access depends on the request URL, it's configured in Gateway's application.yml. Gateway is implemented by spring-cloud-gateway
  4. Gateway get the response from ResourceServer, then return to Client.

2. Get sample applications

Get samples applications from in GitHub: spring-cloud-gateway.

3. Create resources in Azure

3.1. Create a tenant

Read document about creating a Microsoft Entra tenant, create a new tenant. Get the tenant-id: ${TENANT_ID}.

After creating a new tenant, You can refer to README.md if you want to start the sample without the knowledge of step by step.

3.2. Add a new user

Read document about adding users, add a new user: user-1@${tenant-name}.com. Get the user's password.

3.3. Register client-1

Read document about registering an application, register an application named client-1. Get the client-id: ${CLIENT_1_CLIENT_ID}.

3.4. Add a client secret for client-1

Read document about adding a client secret, add a client secret. Get the client-secret value: ${CLIENT_1_CLIENT_SECRET}.

3.5. Add a redirect URI for client-1

Read document about adding a redirect URI, add 2 redirect URIs: http://localhost:8080/login/oauth2/code/client-1-resource-server-1, http://localhost:8080/login/oauth2/code/client-1-resource-server-2.

3.6. Register resource-server-1

Read document about registering an application, register an application named resource-server-1. Get the client-id: ${RESOURCE_SERVER_1_CLIENT_ID}.

3.7. Expose apis for resource-server-1

Read document about exposing an api, expose 2 scopes for resource-server-1: resource-server-1.scope-1 and resource-server-1.scope-2, choose Admins and users for Who can consent option.

3.8. Set accessTokenAcceptedVersion to 2 for resource-server-1

Read document about Application manifest, set accessTokenAcceptedVersion to 2.

3.9. Register resource-server-2

Read document about registering an application, register an application named resource-server-2. Get the client-id: ${RESOURCE_SERVER_2_CLIENT_ID}.

3.10. Expose apis for resource-server-2

Read document about exposing an api, expose 2 scopes for resource-server-2: resource-server-2.scope-1 and resource-server-2.scope-2, choose Admins and users for Who can consent option.

3.11. Set accessTokenAcceptedVersion to 2 for resource-server-2

Read document about Application manifest, set accessTokenAcceptedVersion to 2.

4. Run sample applications

  1. Open sample application: client, fill the placeholders in application.yml, then run the application.
  2. Open sample application: gateway, fill the placeholders in application.yml, then run the application.
  3. Open sample application: resource-server-1, fill the placeholders in application.yml, then run the application.
  4. Open sample application: resource-server-2, fill the placeholders in application.yml, then run the application.
  5. Open browser(for example: Edge), close all InPrivate window, and open a new InPrivate window.
  6. Access http://localhost:8080/, it will return Hello, this is client-1..
  7. Access http://localhost:8080/resource-server-1, it will redirect to Microsoft consent page.
  8. Input username and password (update password if it requests you to), it will return permission request page: let user permit client-1 to access resource-server-1.
  9. Click Accept, then it will return Hello, resource-server-1.. This means Client can access ResourceServer1 through Gateway successfully.
  10. Access http://localhost:8080/resource-server-2, consent as before, it will return Hello, this is resource-server-2..

5. Homework

  1. Read rfc6749.