,来自 spring boot 微服务的 web api 调用

Question

I have 2 spring boot microservices hosted on Kubernetes cluster - app A n auth. app A redirects to auth service getToken api to get a custom jwt token which is a protected API using IBM AppId so before getToken is called, it auto redirects to appId to authenticate user. After successful auth from appId, custom token is set in cookie and request redirected back to auth A. Now currently my implementation uses cookies. app A in filters tries to find the required cookie, if not found, redirects to auth using resp.sendredirect to token api. app A then is able to find the cookie and gives access to the user to its APIs. Now my issue is, that since i am using resp.sendredirect, i see auth service url in the browser which i dont want, but still trigger web api from app A to get somehow get token even if not in cookie.

1. Is there a way to call web api from app A service without using resp.redirect in spring boot like forward or rest template such that the flow is still triggered and my auth service url not shown in browser?
2. Token instead of setting in cookie, can be propagated in any other way such that another app B can also use the same token for auth to simulate SSO scenario for that user without hitting getToken endpoint of auth again ?

Please help as i need to have this SSO enabled based on custom token and also dont want my auth service urls exposed on the browser too.

Answer 1

Is there a way to call web api from app A service without using redirect?

Since you are using OpenID Connect that is based on OAuth2, this is the way it works when the user is not authenticated already.

Token instead of setting in cookie, can be propagated in any other way such that another app B can also use the same token for auth to simulate SSO scenario for that user without hitting getToken endpoint of auth again ? Please help as i need to have this SSO enabled based on custom token and also dont want my auth service urls exposed on the browser too.

When using OpenID Connect to authenticate to a service, the service name should be in the Token. But you may consider all "Deployments" in your cluster as a "single service" (but a distributed microservice architecture), then you can do the Authentication / Token validation in the Gateway on the way into the cluster. This is called like Identity Aware Proxy or API Gatways usually have this functionality.