I have setup a spring Cloud Gateway with Auth by keycloak but wanted to add Policy Enforcer of Keycloak for Fine Grained Authorisation. So that Cloud gateway will do the authorisation, and policy enforcement. And each microservies can act as a OAuth2 resource servers.
If its doable using Spring feature then its an added bonus. But a solution with Keycloak adapter is also fine.
UPDATE
Adding my Security Config
@EnableWebFluxSecurity public class SecurityConfig {
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http,
ReactiveClientRegistrationRepository clientRegistrationRepository) {
http.authorizeExchange()
.anyExchange().authenticated()
.and()
.securityContextRepository(NoOpServerSecurityContextRepository.getInstance());
http.headers().frameOptions().mode(Mode.SAMEORIGIN);
http.csrf().disable();
return http.build();
}
}