chapter twelve

12 Security: Authorization and auditing

 

This chapter covers:

  • Authorization and roles with Spring Cloud Gateway and OAuth2
  • Protecting APIs with Spring Security and OAuth2 (imperative)
  • Protecting APIs with Spring Security and OAuth2 (reactive)
  • Protecting and auditing data with Spring Security and Spring Data

In the previous chapter, I introduced access control systems for cloud native applications. You saw how to add authentication to Edge Service with Spring Security and OpenID Connect, manage the user session lifecycle, and address CORS and CSRF concerns when integrating an Angular front-end with Spring Boot.

By delegating the authentication step to Keycloak, Edge Service is not affected by the specific authentication strategy. As an example, we used the login form feature offered by Keycloak, but we could also enable social login via GitHub or rely on an existing Active Directory to authenticate users. Edge Service only needs to support OIDC to verify the authentication happened correctly and get information about the user via an ID Token.

There are still a few issues we haven’t addressed. Polar Bookshop is a distributed system. After a user authenticates successfully with Keycloak, Edge Service is supposed to interact with Catalog Service and Order Service on behalf of the user. How can we propagate the authentication context to the other applications in the system? This chapter will help you solve that problem using OAuth2 and Access Tokens.

12.1 Authorization and roles with Spring Cloud Gateway and OAuth2

12.1.1 Token Relay from Spring Cloud Gateway to other services

12.1.2 Customizing tokens and propagating user roles

12.2 Protecting APIs with Spring Security and OAuth2 (imperative)

12.2.1 Securing Spring Boot as an OAuth2 Resource Server

12.2.2 Role-based access control with Spring Security and JWT

12.2.3 Testing OAuth2 with Spring Security and Testcontainers

12.3 Protecting APIs with Spring Security and OAuth2 (reactive)

12.3.1 Securing Spring Boot as an OAuth2 Resource Server

12.3.2 Testing OAuth2 with Spring Security and Spring Cloud Contract

12.4 Protecting and auditing data with Spring Security and Spring Data

12.4.1 Auditing data and their users with Spring Security and Spring Data JDBC

12.4.2 Testing data auditing with Spring Data and @WithMockUser

12.4.3 Protecting user data with Spring Security and Spring Data R2DBC

12.4.4 Testing data auditing and protection with @WithMockUser and Spring Data R2DBC