Autherization service is not responsding with access_token while using zuul gateway

Question

I created multiple microservices with springboot 1.4. Last week I decided to implement oauth2 authorization service. My plan is something like,

Every request should be handled by zuul gateway which is registered by Eureka.
So the new Authorization service will be called by eureka to get access_token.

The problem I found is that I can able to get JWT access token directly from authorization server which is running in an another port(8081). when I tried to get the jwt token via zuul gateway, unfortunately I am getting an empty string.

Please take a look at my gateway configuration

application.yml (zuul-gateway)

 zuul:
   routes: 
    static:
    path: /static/** 
   uaa:
    path: /uaa/**
    sensitive-headers: 
    serviceId: microservice-security-oauth2-server
   users:
    path: /users/**
    serviceId: microservice-core-user



security:
 basic:
  enabled: false

application class of zuul is

 @SpringBootApplication
 @EnableZuulProxy
 @EnableEurekaClient
 @ComponentScan(basePackages={"com.configuration","com.zullfilter"})
 public class ZullGatewayServerApplication {

    public static void main(String[] args) {
      SpringApplication.run(ZullGatewayServerApplication.class, args);
    }

}

and the authorization server configuration class is

   @Configuration
   @EnableAuthorizationServer
   public class OAuth2AuthorizationConfiguration extends  AuthorizationServerConfigurerAdapter {

@Autowired
private AuthenticationManager authenticationManager;

@Autowired
private Environment environment;

@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    endpoints.tokenStore(tokenStore())
            .tokenEnhancer(jwtTokenEnhancer())
            .authenticationManager(authenticationManager);
}

@Override
public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    security.tokenKeyAccess("permitAll()")
            .checkTokenAccess("isAuthenticated()");
}

@Bean
public TokenStore tokenStore() {
    return new JwtTokenStore(jwtTokenEnhancer());
}

@Bean
protected JwtAccessTokenConverter jwtTokenEnhancer() {
    String pwd = environment.getProperty("keystore.password");
    KeyStoreKeyFactory keyStoreKeyFactory = new KeyStoreKeyFactory(
            new ClassPathResource("jwt.jks"),
            pwd.toCharArray());
    JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
    converter.setKeyPair(keyStoreKeyFactory.getKeyPair("jwt"));
    return converter;
}

@Override
public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.inMemory()
            .withClient("service-account-1")
            .secret("service-account-1-secret")
            .authorizedGrantTypes("client_credentials")
            .scopes("resource-server-read", "resource-server-write")
            .accessTokenValiditySeconds(6000);
 }
}

I am getting access_token requesting directly to

 curl service-account-1:service-account-1-secret@localhost:8081/uaa/oauth/token -d grant_type=client_credentials

but when I am trying this with zuul proxy then I am getting an empty string

 curl service-account-1:service-account-1-secret@localhost:8765/uaa/oauth/token -d grant_type=client_credentials

I am using zuul gateway version of 1.3 and spring boot 1.4

if anybody have faced this issue before please let me know

Eric Goode Eric Goode · Accepted Answer · 2017-10-05T17:49:23

In my case the solution was to tell Zuul not to strip the prefix. I was hitting the wrong url on the auth server and getting a 401 forbidden and Zuul was swallowing the error and returning 200.

zuul:
  routes:
    auth:
      path: /oauth/**
      serviceId: saapi-auth-server
      stripPrefix: false
      sensitiveHeaders: true

I have a ResourceServerConfigurerAdapter like this below on the Zuul client. I had to disable CSRF, but all of our calls are system to system so we should be good.

@Configuration
@EnableResourceServer
public class JwtSecurityConfig extends ResourceServerConfigurerAdapter {

@Override
public void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .antMatchers("/oauth/**").permitAll()
            .antMatchers("/api/**").hasAuthority("ROLE_API_ACCESS")
            .and()
            .csrf().disable();
    }
}

Autherization service is not responsding with access_token while using zuul gateway

1 Answers