diff --git a/spring-cloud.html b/spring-cloud.html index f96c1b9..23eda7f 100644 --- a/spring-cloud.html +++ b/spring-cloud.html @@ -533,7 +533,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b
  • Token Relay
    • -
  • Configuring Downstream Authentication
    • +
  • Configuring Authentication Downstream of a Zuul Proxy
    • @@ -3311,6 +3311,14 @@ public class JwtCustomization extends DefaultAccessTokenConverter implements

    Token Relay

    +

    A Token Relay is where an OAuth2 consumer acts as a Client and +forwards the incoming token to outgoing resource requests. The +consumer can be a pure Client (like an SSO application) or a Resource +Server.

    +
    +
    +

    Client Token Relay

    +

    If your app has a Spring Cloud Zuul embedded reverse proxy (using @EnableZuulProxy) then you @@ -3346,10 +3354,40 @@ just extracts an access token from the currently authenticated user, and puts it in a request header for the downstream requests.

    +
    +

    Resource Server Token Relay

    +
    +

    If your app has @EnableOAuth2Resource and also is a Client (i.e. it +has a spring.oauth2.client.clientId, even if it doesn’t use it), +then the OAuth2RestOperations that is provided for @Autowired +users by Spring Cloud (it is declared as @Primary) will also forward +tokens. If you don’t want to forward tokens (and that is a valid +choice, since you might want to act as yourself, rather than the +client that sent you the token), then you only need to create your own +OAuth2RestOperations instead of autowiring the default one. Here’s +a basic example showing the use of the autowired rest template ("foo.com" +is a Resource Server accepting the same tokens as the surrounding app):

    +
    +
    +
    MyController.java
    +
    +
    @Autowired
+private OAuth2RestOperations restTemplate;
+
+@RequestMapping("/relay")
+public String relay() {
+    ResponseEntity<String> response =
+      restTemplate.getForEntity("https://foo.com/bar", String.class);
+    return "Success! (" + response.getBody() + ")";
+}
    +
    +
    +
    +
    -

    Configuring Downstream Authentication

    +

    Configuring Authentication Downstream of a Zuul Proxy

    You can control the authorization behaviour downstream of an @@ -3383,7 +3421,7 @@ ProxyAuthenticationProperties for full details.