diff --git a/spring-cloud.html b/spring-cloud.html index 0422d3b..be13dab 100644 --- a/spring-cloud.html +++ b/spring-cloud.html @@ -523,6 +523,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b
  • Token Relay
    • +
  • Configuring Downstream Authentication
  • Spring Cloud for Cloud Foundry @@ -2655,34 +2656,56 @@ following properties in the Environment:

    - +"value" field) with oauth2.resource.jwt.keyUri. E.g. on PWS:

    $ curl https://uaa.run.pivotal.io/token_key
 {"alg":"SHA256withRSA","value":"-----BEGIN PUBLIC KEY-----\nMIIBI...\n-----END PUBLIC KEY-----\n"}
    +
    • + + +
    + + + + + +
    +
    Warning
    +    		 +If you use the oauth2.resource.jwt.keyUri the authorization +server needs to be running when your application starts up. It will +log a warning if it can’t find the key, and tell you what to do to fix +it. +
    +

    You can set the preferred scope (as a comma-separated list or YAML array) in oauth2.client.scope. It defaults to empty, in which case @@ -2690,10 +2713,38 @@ most Authorization Servers will ask the user for approval for the maximum allowed scope for the client.

    -

    There is also a setting for oauth2.client.authenticationScheme which +

    There is also a setting for oauth2.client.clientAuthenticationScheme which defaults to "header" (but you might need to set it to "form" if, like Github for instance, your OAuth2 provider doesn’t like header -authentication).

    +authentication). The oauth2.client.* properties are bound to an instance +of AuthorizationCodeResourceDetails so all its properties can be specified.

    +
    +
    + + + + + +
    +
    Tip
    +    		 +
    +

    To set an RSA key value in YAML use the "pipe" continuation +marker to split it over multiple lines ("|") and remember to indent +the key value (it’s a standard YAML language feature). Example:

    +
    +
    +
    +
    oauth2:
+  resource:
+    jwt:
+      keyValue: |
+        -----BEGIN PUBLIC KEY-----
+        MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC...
+        -----END PUBLIC KEY-----
    +
    +
    +

    Access Decision Rules

    @@ -2716,7 +2767,7 @@ the matching patterns for the OAuth2 SSO, even if you have OAuth2SsoConfigurer beans as well. The default logout path is "/logout" and it gets similar treatment, as does the "home" page (which is the logout success page, defaults to "/"). Those paths can -be overriden by setting oauth2.sso.\*' (`loginPath, logoutPath and +be overriden by setting oauth2.sso.*' (`loginPath, logoutPath and home.path).

    @@ -2752,9 +2803,9 @@ doesn’t need a clientId and clientSecret if it i tokenInfoUri (i.e. if it has jwt.* or userInfoUri).

    -

    By default all your endpoints are protected (i.e. "/") but you can +

    By default all your endpoints are protected (i.e. "/**") but you can pick and choose by adding a ResourceServerConfigurerAdapter (standard -Spring OAuth feature), e.g. to protect only the "/api/" resources

    +Spring OAuth feature), e.g. to protect only the "/api/**" resources

    Application.java
    @@ -2772,9 +2823,9 @@ class Application extends ResourceServerConfigurerAdapter { .anyRequest().authenticated(); } - @RequestMapping('/api') - String home() { - 'Hello World' + @RequestMapping("/api") + public String home() { + return "Hello World"; } } @@ -2798,12 +2849,6 @@ it is proxying. Thus the SSO app above can be enhanced simply like this:

    @EnableZuulProxy class Application { - @RequestMapping('/') - @ResponseBody - String home() { - 'Hello World' - } - }
    @@ -2824,6 +2869,12 @@ classpath (via @EnableZuulProxy). The just extracts an access token from the currently authenticated user, and puts it in a request header for the downstream requests.

    + + + +
    +

    Configuring Downstream Authentication

    +

    You can control the authorization behaviour downstream of an @EnableZuulProxy through the proxy.auth.* settings. Example:

    @@ -2853,7 +2904,6 @@ ProxyAuthenticationProperties for full details.

    -

    Spring Cloud for Cloud Foundry

    @@ -3033,7 +3083,7 @@ service or the "resource" service if you have one).