0

I have a bunch of services that sit behind a Zuul Edge Server. The Zuul Edge Server also performs authentication. The session is shared with all services using Spring Session. I want to be able to authenticate and route the request to a service in the same flow. I looked at Dave Syer's tutorial where a Gateway Server can authenticate and route requests.

On that project, the following commands work:

  • curl -u admin:admin http://localhost:8080/user
  • curl -c cookie.txt -u admin:admin http://localhost:8080/user && curl -b cookie.txt http://localhost:8080/admin/user

I was expecting this to work as well but it doesn't:

  • curl -u admin:admin http://localhost:8080/admin/user

I was expecting the Gateway server to authenticate, create a redis session, route the request to admin service which would have picked the Authentication from redis session. The request is being routed to admin service, but it also attempts a Basic Authentication and fails.

This is what I see in admin service's logs:

o.s.s.w.a.www.BasicAuthenticationFilter  : Basic Authentication Authorization header found for user 'admin'
o.s.s.authentication.ProviderManager     : Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
o.s.s.a.dao.DaoAuthenticationProvider    : User 'admin' not found
o.s.s.w.a.www.BasicAuthenticationFilter  : Authentication request for failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials

I get an HTTP 401 Unauthorized response.

I also tried to disable HTTP Basic Authentication in admin service, but then I get HTTP 403 Forbidden response.

Is there some way to achieve this?

UPDATE

I think this can't work due to the way Spring Session is implemented to save session. I'm waiting for a response to my question on github.

cryptonite
  • 23
  • 5
  • Does `admin/user` url pattern pass through spring-security filters in gateway without authentication? Is it configured to commence authentication ? – Ahamed Mustafa M Dec 27 '15 at 11:07
  • @AhamedMustafaM No, it can't. It's protected by Basic Auth. – cryptonite Dec 28 '15 at 04:34
  • I'm developing very similar architecture. It would be nice if the first call could authenticate and access a service via zuul. Currently I've just put a 'login' endpoint on mu zuul service that does not require a trip to another service. It is still an uneccesary step, but it at least makes logical sense for clients trying to access the api. – Tim Schimandle Jan 04 '16 at 00:43
  • I think solution was already implemented in `spring-session` version 1.1.0. More info in another question http://stackoverflow.com/questions/34751700/spring-zuul-api-gateway-with-spring-session-redis-authenticate-and-route-in-sa?rq=1#answer-38867506 – shobull Sep 24 '16 at 22:13

0 Answers0