微服务授权和会话维护-Spring Boot

Question

I have application that I want to divide into micro-services to increase overall performance on high load. Overall structure I plan to create like this:

Web -> Authorization Server -> Eureka + Zulu -> Spring boot Micro-services

Since my previous application was monolith I used Spring boot + Spring security and had no problem while logging things like @CreatedBy @LastModifiedBy - I laso use Aspects to log every action in app and track who made the changes. Now since I don't have session across microservicies I don't know what to do - I do need to log the action owners - log who is doing what.

Can someone tell me how can I maintain the logging possibilities in my new structure. Maybe there is some ready made patters or maybe I need to make some changes in my structure?

Answer 1

How are you dealing with authorization? If the web component calls the authorization server with an authentication token, that token should be forwarded when calling microservices. Every microservice should be stateless (so, no session is ever stored), and that token should contain information about the user so each microservice can access it and authenticate requests.

If you could specify what you mean by Authorization Server, I'll be glad to explain in greater detail.