New Blog Post in Microservice

Adding the password grant type to Spring Authorization Server

 security    api gateway  

---

---

From time to time, I’ve created sample applications that included an API Gateway that authenticates client requests and passes to the backend services a JWT containing the client’s identity and roles. The big picture is as follows:

First, I’ll describe the request flow and then I’ll explain how I enhanced the Spring Authorization Server.

Using a security server

To avoid reinventing the wheel, the applications use an off-the-shelf security service that’s responsible for:

• Authenticating client credentials
• Issuing a JWT, which is signed with a private key
• Providing access to the corresponding public key that a backend service uses to validate the JWT

The flow is as follows:

1. The API Gateway authenticates the client’s credentials (username/password aka API key/secret)
2. The API Gateway invokes a backend service with a (REST) requests, which includes a JWT, which contains the client’s identity and roles.
3. The backend service validates the JWT
4. The backend service authorizes the client to access the requested resource.