I'm trying to run an oauth2 authorization server (spring-security-oauth2 2.2.1.RELEASE) behind a spring cloud gateway (spring-cloud-gateway 2.0.0.M5), both with spring boot 2.0.0.RC1. If i call directly the authorization server it works correctly, but if i call it through the gateway (with curl or with the browser) the call remains stuck without an answer. I checked this on both Windows 10 and Mac, in both the applications were running on Java 9.
If i run the applications with the debug logging level i got this outputs when running curl client:secret@localhost:8080 -d grant_type=password -d password=password -d username=username -v:
on the authorization server i got only this log:
2018-02-08 17:17:41.816 DEBUG 132 --- [8081-Acceptor-0] o.apache.tomcat.util.threads.LimitLatch : Counting up[http-nio-8081-Acceptor-0] latch=1
on the gateway i got:
2018-02-08 17:19:06.170 DEBUG 18856 --- [ctor-http-nio-1] r.ipc.netty.http.server.HttpServer : [id: 0x1ad52031, L:/0:0:0:0:0:0:0:0:8080] READ: [id: 0x6d119e6b, L:/127.0.0.1:8080 - R:/127.0.0.1:52564]
2018-02-08 17:19:06.171 DEBUG 18856 --- [ctor-http-nio-1] r.ipc.netty.http.server.HttpServer : [id: 0x1ad52031, L:/0:0:0:0:0:0:0:0:8080] READ COMPLETE
2018-02-08 17:19:06.171 DEBUG 18856 --- [ctor-http-nio-4] r.i.n.http.server.HttpServerOperations : New http connection, requesting read
2018-02-08 17:19:06.171 DEBUG 18856 --- [ctor-http-nio-4] r.ipc.netty.channel.ContextHandler : After pipeline DefaultChannelPipeline{(reactor.left.loggingHandler = io.netty.handler.logging.LoggingHandler), (ServerContextHandler#0 = reactor.ipc.netty.channel.ServerContextHandler), (reactor.left.httpCodec = io.netty.handler.codec.http.HttpServerCodec), (reactor.left.httpServerHandler = reactor.ipc.netty.http.server.HttpServerHandler), (reactor.right.reactiveBridge = reactor.ipc.netty.channel.ChannelOperationsHandler)}
2018-02-08 17:19:06.171 DEBUG 18856 --- [ctor-http-nio-4] r.ipc.netty.http.server.HttpServer : [id: 0x6d119e6b, L:/127.0.0.1:8080 - R:/127.0.0.1:52564] REGISTERED
2018-02-08 17:19:06.171 DEBUG 18856 --- [ctor-http-nio-4] r.ipc.netty.http.server.HttpServer : [id: 0x6d119e6b, L:/127.0.0.1:8080 - R:/127.0.0.1:52564] ACTIVE
2018-02-08 17:19:06.172 DEBUG 18856 --- [ctor-http-nio-4] r.ipc.netty.http.server.HttpServer : [id: 0x6d119e6b, L:/127.0.0.1:8080 - R:/127.0.0.1:52564] READ: 246B
+-------------------------------------------------+
| 0 1 2 3 4 5 6 7 8 9 a b c d e f |
+--------+-------------------------------------------------+----------------+
|00000000| 50 4f 53 54 20 2f 20 48 54 54 50 2f 31 2e 31 0d |POST / HTTP/1.1.|
|00000010| 0a 48 6f 73 74 3a 20 6c 6f 63 61 6c 68 6f 73 74 |.Host: localhost|
|00000020| 3a 38 30 38 30 0d 0a 41 75 74 68 6f 72 69 7a 61 |:8080..Authoriza|
|00000030| 74 69 6f 6e 3a 20 42 61 73 69 63 20 59 32 78 70 |tion: Basic Y2xp|
|00000040| 5a 57 35 30 4f 6e 4e 6c 59 33 4a 6c 64 41 3d 3d |ZW50OnNlY3JldA==|
|00000050| 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 63 75 |..User-Agent: cu|
|00000060| 72 6c 2f 37 2e 34 37 2e 30 0d 0a 41 63 63 65 70 |rl/7.47.0..Accep|
|00000070| 74 3a 20 2a 2f 2a 0d 0a 43 6f 6e 74 65 6e 74 2d |t: */*..Content-|
|00000080| 4c 65 6e 67 74 68 3a 20 35 35 0d 0a 43 6f 6e 74 |Length: 55..Cont|
|00000090| 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 |ent-Type: applic|
|000000a0| 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d |ation/x-www-form|
|000000b0| 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a 0d 0a 67 |-urlencoded....g|
|000000c0| 72 61 6e 74 5f 74 79 70 65 3d 70 61 73 73 77 6f |rant_type=passwo|
|000000d0| 72 64 26 70 61 73 73 77 6f 72 64 3d 70 61 73 73 |rd&password=pass|
|000000e0| 77 6f 72 64 26 75 73 65 72 6e 61 6d 65 3d 75 73 |word&username=us|
|000000f0| 65 72 6e 61 6d 65 |ername |
+--------+-------------------------------------------------+----------------+
2018-02-08 17:19:06.172 DEBUG 18856 --- [ctor-http-nio-4] r.i.n.http.server.HttpServerOperations : Increasing pending responses, now 1
2018-02-08 17:19:06.172 DEBUG 18856 --- [ctor-http-nio-4] r.ipc.netty.http.server.HttpServer : [id: 0x6d119e6b, L:/127.0.0.1:8080 - R:/127.0.0.1:52564] READ COMPLETE
2018-02-08 17:19:06.172 DEBUG 18856 --- [ctor-http-nio-4] r.ipc.netty.channel.ChannelOperations : [HttpServer] [id: 0x6d119e6b, L:/127.0.0.1:8080 - R:/127.0.0.1:52564] handler is being applied: org.springframework.http.server.reactive.ReactorHttpHandlerAdapter@2adaf15
2018-02-08 17:19:06.173 DEBUG 18856 --- [ctor-http-nio-4] o.s.web.reactive.DispatcherHandler : Processing POST request for [http://localhost:8080/]
2018-02-08 17:19:06.173 DEBUG 18856 --- [ctor-http-nio-4] s.w.r.r.m.a.RequestMappingHandlerMapping : Looking up handler method for path /
2018-02-08 17:19:06.173 DEBUG 18856 --- [ctor-http-nio-4] s.w.r.r.m.a.RequestMappingHandlerMapping : Did not find handler method for [/]
2018-02-08 17:19:06.173 DEBUG 18856 --- [ctor-http-nio-4] o.s.c.g.h.RoutePredicateHandlerMapping : RouteDefinition matched: 306be04f-f762-488a-b24d-47be9748ad34
2018-02-08 17:19:06.173 DEBUG 18856 --- [ctor-http-nio-4] o.s.c.g.h.RoutePredicateHandlerMapping : Mapping [Exchange: POST http://localhost:8080/] to Route{id='306be04f-f762-488a-b24d-47be9748ad34', uri=http://localhost:8081/oauth/token, order=0, predicate=org.springframework.cloud.gateway.handler.predicate.PathRoutePredicateFactory$$Lambda$295/218688965@63309ea4, gatewayFilters=[]}
2018-02-08 17:19:06.173 DEBUG 18856 --- [ctor-http-nio-4] o.s.c.g.handler.FilteringWebHandler : Sorted gatewayFilterFactories: [OrderedGatewayFilter{delegate=GatewayFilterAdapter{delegate=org.springframework.cloud.gateway.filter.NettyWriteResponseFilter@b0a1231}, order=-1}, OrderedGatewayFilter{delegate=GatewayFilterAdapter{delegate=org.springframework.cloud.gateway.filter.RouteToRequestUrlFilter@4833eff3}, order=10000}, OrderedGatewayFilter{delegate=GatewayFilterAdapter{delegate=org.springframework.cloud.gateway.filter.NettyRoutingFilter@2676dc05}, order=2147483647}, OrderedGatewayFilter{delegate=GatewayFilterAdapter{delegate=org.springframework.cloud.gateway.filter.ForwardRoutingFilter@4694f434}, order=2147483647}, OrderedGatewayFilter{delegate=GatewayFilterAdapter{delegate=org.springframework.cloud.gateway.filter.WebsocketRoutingFilter@56928e17}, order=2147483647}]
2018-02-08 17:19:06.174 DEBUG 18856 --- [ctor-http-nio-4] r.i.n.c.PooledClientContextHandler : Acquiring existing channel from pool: DefaultPromise@395fcfef(incomplete) SimpleChannelPool{activeConnections=0}
2018-02-08 17:19:06.174 DEBUG 18856 --- [ctor-http-nio-6] r.i.n.resources.DefaultPoolResources : Created [id: 0xb483ea9b], now 1 active connections
2018-02-08 17:19:06.174 DEBUG 18856 --- [ctor-http-nio-6] r.ipc.netty.channel.ContextHandler : After pipeline DefaultChannelPipeline{(reactor.left.loggingHandler = io.netty.handler.logging.LoggingHandler), (SimpleChannelPool$1#0 = io.netty.channel.pool.SimpleChannelPool$1), (reactor.left.httpCodec = io.netty.handler.codec.http.HttpClientCodec), (reactor.right.reactiveBridge = reactor.ipc.netty.channel.ChannelOperationsHandler)}
2018-02-08 17:19:06.174 DEBUG 18856 --- [ctor-http-nio-6] r.ipc.netty.http.client.HttpClient : [id: 0xb483ea9b] REGISTERED
2018-02-08 17:19:06.174 DEBUG 18856 --- [ctor-http-nio-6] r.ipc.netty.http.client.HttpClient : [id: 0xb483ea9b] CONNECT: localhost/127.0.0.1:8081
2018-02-08 17:19:06.175 DEBUG 18856 --- [ctor-http-nio-6] r.ipc.netty.http.client.HttpClient : [id: 0xb483ea9b, L:/127.0.0.1:52565 - R:localhost/127.0.0.1:8081] ACTIVE
2018-02-08 17:19:06.175 DEBUG 18856 --- [ctor-http-nio-6] r.i.n.c.PooledClientContextHandler : Acquired active channel: [id: 0xb483ea9b, L:/127.0.0.1:52565 - R:localhost/127.0.0.1:8081]
2018-02-08 17:19:06.175 DEBUG 18856 --- [ctor-http-nio-6] r.ipc.netty.channel.ChannelOperations : [HttpClient] [id: 0xb483ea9b, L:/127.0.0.1:52565 - R:localhost/127.0.0.1:8081] handler is being applied: HttpClientHandler{startURI=http://localhost:8081/oauth/token, method=POST, handler=org.springframework.cloud.gateway.filter.NettyRoutingFilter$$Lambda$443/633701416@335243d7}
2018-02-08 17:19:06.176 DEBUG 18856 --- [ctor-http-nio-6] r.ipc.netty.http.client.HttpClient : [id: 0xb483ea9b, L:/127.0.0.1:52565 - R:localhost/127.0.0.1:8081] USER_EVENT: reactor.ipc.netty.NettyPipeline$SendOptionsChangeEvent@31db44d0
2018-02-08 17:19:06.176 DEBUG 18856 --- [ctor-http-nio-6] r.i.n.channel.ChannelOperationsHandler : [id: 0xb483ea9b, L:/127.0.0.1:52565 - R:localhost/127.0.0.1:8081] New sending options
2018-02-08 17:19:06.176 DEBUG 18856 --- [ctor-http-nio-4] reactor.ipc.netty.channel.FluxReceive : [id: 0x6d119e6b, L:/127.0.0.1:8080 - R:/127.0.0.1:52564] Subscribing inbound receiver [pending: 1, cancelled:false, inboundDone: true]
2018-02-08 17:19:06.177 DEBUG 18856 --- [ctor-http-nio-6] reactor.ipc.netty.ReactorNetty : Added encoder [reactor.left.chunkedWriter] at the beginning of the user pipeline, full pipeline: [reactor.left.loggingHandler, reactor.left.httpCodec, reactor.left.chunkedWriter, reactor.right.reactiveBridge, DefaultChannelPipeline$TailContext#0]
2018-02-08 17:19:06.177 DEBUG 18856 --- [ctor-http-nio-6] r.i.n.channel.ChannelOperationsHandler : [id: 0xb483ea9b, L:/127.0.0.1:52565 - R:localhost/127.0.0.1:8081] Writing object io.netty.handler.codec.http.multipart.HttpPostRequestEncoder$WrappedFullHttpRequest@6235dbbf
and curl outputs this and get stuck:
* Rebuilt URL to: client:secret@localhost:8080/
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'client'
> POST / HTTP/1.1
> Host: localhost:8080
> Authorization: Basic Y2xpZW50OnNlY3JldA==
> User-Agent: curl/7.47.0
> Accept: */*
> Content-Length: 55
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 55 out of 55 bytes
if i run curl client:secret@localhost:8081/oauth/token -d grant_type=password -d password=password -d username=username (call directly the auth server) i got successfully a token.
My spring cloud gateway is a simple spring boot application with this configuration running on port 8080:
@Configuration
public class GatewayConfiguration {
@Bean
public RouteLocator routes(RouteLocatorBuilder builder) {
return builder.routes().route(spec -> spec.path("/").uri("http://localhost:8081/oauth/token")).build();
}
}
And the configuration of the oauth authorization server running on port 8081 is this:
@Configuration
@EnableAuthorizationServer
public class AuthorizationConfiguration extends AuthorizationServerConfigurerAdapter {
private final AuthorizationServerTokenServices tokenServices;
private final AuthenticationManager authenticationManager;
@Autowired
public AuthorizationConfiguration(AuthorizationServerTokenServices tokenServices,
AuthenticationManager authenticationManager) {
super();
this.tokenServices = Objects.requireNonNull(tokenServices);
this.authenticationManager = Objects.requireNonNull(authenticationManager);
}
@Override
public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {
configurer.inMemory().withClient("client").secret("secret").authorizedGrantTypes("password", "refresh_token")
.scopes("read");
}
@Override
public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
endpoints.tokenServices(this.tokenServices).authenticationManager(this.authenticationManager);
}
@Override
public void configure(AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
oauthServer.passwordEncoder(NoOpPasswordEncoder.getInstance());
}
}
and this:
@Configuration
@EnableWebSecurity
@EnableGlobalAuthentication
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and().httpBasic().and().csrf()
.disable();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("username").password("password").authorities("ROLE_USER").and()
.passwordEncoder(NoOpPasswordEncoder.getInstance());
}
@Bean
public TokenStore tokenStore() {
return new InMemoryTokenStore();
}
@Bean
@Primary
public DefaultTokenServices tokenServices() {
DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
defaultTokenServices.setTokenStore(tokenStore());
defaultTokenServices.setSupportRefreshToken(true);
defaultTokenServices.setAccessTokenValiditySeconds(5000);
defaultTokenServices.setRefreshTokenValiditySeconds(5000);
return defaultTokenServices;
}
@Bean
@Override
protected AuthenticationManager authenticationManager() throws Exception {
return super.authenticationManager();
}
}
The complete code with the gradle dependencies is in this repository ( https://gitlab.com/Kenzow/spring-gateway-test ). I don't know if i should open an issue in the spring repository or is just a problem with my configuration. I have other microservices (and other working endpoints on the authorization server) running behind the same gateway and no other is having any problem.
