This project exposes REST endpoints (accessed by API gateway). They are secured by OAuth2. There is one REST endpoint defined in AuthRestController.java that is not secured. This endpoint is used by the API gateway to determine the roles of authenticating users.

How to determine the user on behalf of whome a request is being made by the API gateway and the roles of that user?

Since this is secured as an OAuth2 resource server, OAuth2 access token send with HTTP requests can just be used to authenticate the user.

Assuming that the OAuth2 access token doesn't hold user roles, a different strategy should be used to determine user roles. One is to find user roles within this service itself by using the OAuth2 username (which can be trusted). This may for example involve looking for user roles details in a database accessed by this service. That approach can be trusted always but involves additional steps. Another approach is to just use the incoming HTTP request headers (added to the requests by the API gateway). To trust the role details so sent, this service should have been deployed in an access restricted network. Otherwise, an attacker may send HTTP requests with forged headers to make this service assume false user roles. Look at the UserRestController.java for details.


Some pom.xml dependencies:
  To make this Spring Boot project an OAuth2 resource server (Allow access from OAuth2 clients):
    <dependency>
  	  <groupId>org.springframework.boot</groupId>
  	  <artifactId>spring-boot-starter-security-oauth2-resource-server</artifactId>
    </dependency>

  To use H2 in-memory database (as configured in main/src/resources/application.yaml file):
    <dependency>
  	  <groupId>com.h2database</groupId>
  	  <artifactId>h2</artifactId>
  	  <scope>runtime</scope>
    </dependency>

  To use H2 database console accessible via a web browser:
    <dependency>
  	  <groupId>org.springframework.boot</groupId>
  	  <artifactId>spring-boot-h2console</artifactId>
    </dependency>

How to access the H2 database console:
  URL: http://localhost:8052/myservices/h2-console
  Details (as configured in application.yaml file):
    Database name: jdbc:h2:mem:testdb
    Username: sa
    Password: password