Spring Cloud Gateway Authentication and Authorization

0
votes

I am new to spring microservice world. As I am in learning phase, I tried and implemented the following things.

  • Authentication/Authorization as a separate microservice

  • Routing (Able to route using Spring cloud gateway)

  • Load balancing (Netflix Eureka)

  • Rate Limit and Circuit Breaker (Resilience4j)

I just need certain clarification and suggestion on what to do in these situations:

As I already had created Authentication/Authorization as a separate microservice centralized. Now how can I implement such that every request must contain jwt token and pass-through API gateway to call other microservice also it should check which user has permission to access API in other microservice

If some has same good source so that I can learn please do share or if someone has a basic skeleton on GitHub.

1
spring-bootmicroservicesspring-cloud-gateway

1 Answers

0
votes

Requests from outside your cluster should be intercepted/validated by Zuul (example) will be your gatekeeper which will pass the request to the request checker in this case would be your authentication service where the acquired token will be validated (this should exists at the header of the request). One tokens are validated, the request will be routed to the authorization service to check if the user has access to particular endpoint based on your rules defined for access.