I think that incorporating Spring Cloud Security to our project is a natural follow up of what we already have done here. I am only wondering if securing our demo application wound't make it too complicated. I would like to keep this project as simple as possible, helping people to get started with Spring Cloud. Maybe we should create a separate branch for an OAuth2 version? @arey @dsyer

Agree in keeping the project simple, but would be great to have a branch with the OAuth2 implementation.

Would you like to contribute or to leave implementation to someone else? I think we can go with separate branch first and then decide whether to merge secured version to master.

I would be glad to help as much as I can, but I'm not experienced with oauth2 used in microservices. I wanted to use this as a good base to learn the correct way to implement the service.
I could implement what I know till now and then someone else check for improvements

Hi @ScopeSebastian, any update on this? :)

I'd be interested in contributing to this and other security related items. In particular what I would like to add (as individual tutorial branches) is:
1) Securing microservices secrets with Hashicorp Vault
2) OAuth2 authentication
3) Authorization based on both roles and URL in each service
4) Authorization in Angular UI (or maybe migrate to React with auth).

FWIW I have experience in each of these in my day job. What is the process on this project ? Just go ahead and implement then submit a pull request ? Something else ...?

Thank you @pmj0yce for your proposition.
We could have a secure version in a separate branch you'll be in charge to maintain (synchronize with the master branch).
I propose to keep AngularJS. You may go ahead and submit a PR :)

there is any update about Secure version?

We are looking for some contributors. @pmj0yce was interested but I we didn't have any news.

Hi @arey

Ca i take up this issue. @arey Can you provide an outline on this issue. If i am not wrong i should just implement OAuth2 security for microservices,

Hi @arey / @dsyer

Can i take up this issue Can you please advice.

@pmj0yce

Can i go ahead with the issue?

@arey / @dsyer
Can you please brief on what is expected out of this task. I am new to OAuth2 and microservices. Can you please brief on what is expected out of this task so that i can code easily. Please. It is an urgent request.

@arey / @dsyer

May i know whether authentication using google or github is needed for this issue. I have started to work on this issue. Can you please specify the requirements. Please.

I'm not an expert in microservices security but I think we could use the Spring Authorization Server https://www.baeldung.com/spring-security-oauth-auth-server.
I propose to secure with a JWT token both the API from the Gateway and the API the 3 microservices : vets, visits and customers.
Keep in mind that this code shoud live in a separate branch.
If it could help, I'm working on the Spring Cloud 2021.0 and Spring Boot 2.6 migration. See #188

@arey Thanks for the response , the authorization should be for a single user or multiple users with signup and login page. Can you please confirm. Please

@arey / @pmj0yce Can you please confirm

@arey / @dsyer / @pmj0yce Can you please confirm. Should i do in memory authentication or database authentication.

@arey / @dsyer / @pmj0yce Can you please confirm. Should i do in memory authentication or database authentication.

Hi @dsyer / @arey

when i configure spring security for API Gateway, i get the below error message. I removed starter web dependency and i added javax.xml.bind,javax.servlet dependency still the same error. I am stuck with this from 2 days..Can you please advice.

Caused by: java.lang.IllegalStateException: StandardEngine[Tomcat].StandardHost[localhost].TomcatEmbeddedContext[] failed to start
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.rethrowDeferredStartupExceptions(TomcatWebServer.java:187)
at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.initialize(TomcatWebServer.java:126)
... 18 common frames omitted

Any news?

A near reference web-app without authentication and authorization. Unbelievable.

You're right @donhuvy. We have to propose a secured version.
We could use the Spring Authorization Server.
Before starting to work on this issue, we have to clearly define the security architecture.

Thank you for your attention.

I based on a video tutorial use Spring Boot 2.x : https://www.youtube.com/watch?v=vNKVm2vTL2Q&t=7261s It is a great tutorial. https://github.com/mohamedYoussfi/spring-security-jwt-oauth2-oidc

You can see https://github.com/donhuvy/spring_boot_3_oauth2/ I used Spring Boot 3. My limitatation skill: I don't know how to use persistent database (PostgreSQL, MySQL, etc), just mimics and use InMemoryUserDetail . If you know how to persistent user information to real SQL database, please fork, and guide me.

We will not use self-sign OAuth as a monolithic web-app. Need an OAuth2 server microservices and many OAuth2 client. I am not pro in topic Spring Security and Spring Cloud Security.

Hi @arey
FYI I created a workshop using the whole spring boot / cloud stack w/ spring authorization server

https://github.com/alexandre-touret/rest-apis-versioning-workshop

https://github.com/alexandre-touret/rest-apis-versioning-solution

If you want I can implement it in this project

It's this still available, if yes, can I work on it?

Please do. My preference would be to add a security layer to the gateway, and make the other apps clients of that (so they need a token and a token relay where appropriate). The auth server could be a Spring Auth Server (so that we control the user ids).

Hi
I did that in a workshop where I put both spring cloud gateway and spring authorization server in place.

You can get here