Securing each microservices

Question

I have two microservices, that should communicate with each other. My example: Microservice A make a request to Microservice B. Users should not have access, only other microservices. I thought, that solution might be “Http Basic Authentication”, so microservice A should also send username and password to microservice B. That’s fine, but how microservice A should find out that username and password? I am using Eureka as a Discovery Service, but I haven't found anything, that can help my in this case. I only found eureka.client.proxy-user-name and eureka.client.proxy-password, but it didn’t worked for me.

Where are you deploying your microservices? Are you using Kubernetes/Openshift? — nitgeek
@nitgeek i’m new to cloud development, so currently i’m not deploying it. — Munoon
If you are going to deploy to Kubernetes the secrets are used to store credentials. kubernetes.io/docs/concepts/configuration/secret — nitgeek
You'll use Gateway service which will have authentication instead of all the microservices. So MS-A will communicate with MS-B via Gateway. — Muhammad Waqas Dilawar

Shivendra Tiwari Shivendra Tiwari · Accepted Answer · 2020-07-30T08:12:17

Extract the Authorization header from request to Micro Service A add that header inside HTTP Header and make request to Micro service B. Spring Security will validate the header and allow authentication

private WebClient client = null;

@PostConstruct
public void init() {
    client = WebClient.builder().baseUrl("some-url").build();
}

@GetMapping("/getCandidateById/{institutionId}/{id}")
public Mono<Candidate> getCandidateById(@PathVariable String institutionId, @PathVariable String id, ServerHttpRequest request) {
        return client.get()
                .uri("/getCandidateById/{institutionId}/{id}", institutionId, id)
                /*main logic*/.header("Authorization", request.getHeaders().getFirst("Authorization"))
                .retrieve()
                .bodyToMono(Candidate.class);
}

I am extracting header and adding it inside the request which i making by WebClient. Similarly you can use RestTemplate also.

Note: I have used Basic Authentication

Securing each microservices

1 Answers