Spring Cloud-如何在Zuul反向代理上配置OAuth2RestTemplate来传递授权令牌？

Question

I am using Zuul as a reverse proxy for routing of requests to my microservices. I have also enabled resource server (@EnableResourceServer) on this reverse proxy so requests are authorised against my authorisation server. There are no configurations of the resource server, only some bypass of security for a few requests, nothing more. This reverse proxy is also simply passing the OAuth2 headers when routing requsts to other microservices so other microservices are able to do all the security related things as needed. Everything works perfect...but.

One of my zuul filters I have created is filter for resource expansion. It means it automatically gets all the related resources according to provided url parameters (eg for employee resource the url param could be "expand=manager,contacts" and it gets all this additional data using HAL links on employee resource and adds the additional data to _embedded field in JSON).

The problem I have is that when I am doing this expansion, I need to use RestTemplate to do the expansion (to get all the data that should be embedded). I am not able to figure out how to configure the OAuth2RestTemplate so it adds OAuth2 authorization header to outgoing requests. I have tried this from spring cloud documentation:

@Bean
public OAuth2RestTemplate restTemplate(UserInfoRestTemplateFactory factory) {
    return factory.getUserInfoRestTemplate();
}

But I have some null pointer exception from OAuth2TokenRelayFilter. There is a condition inside this filter htat looks like this:

restTemplate.getResource().getClientId()
                .equals(auth.getOAuth2Request().getClientId())

but restTemplate.getResource() returns null and also getClientId() on OAuth2Request instance returns null... Looks like I am really missing something.

Before introducing OAuth2 the setup of RestTemplate was:

@Bean
@LoadBalanced
RestTemplate restTemplate() {
    return new RestTemplate();
}

So as you see load balancing is also needed (Using Ribbon for load balancing, Eureka is used for service discovery that is based one service aliases, so no direct urls in zuul config)

Any suggestionshow to set it up?

Thanks, Lukas

Answer 1

So after some more investigation I have configured the reverse proxy also as OAuth2Client so the security context is properly setup for each request OAuth2TokenRelayFilter started to work.

Spring cloud documentation chapter "Resource Server Token Relay" describes following "rest template will then have the same OAuth2ClientContext (request-scoped) that is used by the authentication filter". ... It means that client have to be enabled by @EnableOAuth2Client so that OAuth2ClientContext is properly set up.

I hope I understand it correctly.

Lukas