blob: b4442339f9242b68b33d51d1bc4134bc330f644b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
server:
port: 8050
address: 127.0.0.1
app:
userRolesUrl: "http://localhost:8052/myservices/api/security/users/{username}/roles"
# logging:
# level:
# org.springframework.security: trace
spring:
application:
name: api-gateway
cloud:
gateway:
server:
webflux:
globalcors:
cors-configurations:
'[/**]':
allowedOrigins:
- "http://localhost:5173"
allowedMethods: "*"
allowedHeaders: "*"
allowCredentials: true
routes:
# Frontend tries to access this URL when the login link is clicked.
# If user is not logged in, user will be redirected to OAuth2 server.
# If logged in, frontend will be reloaded.
- id: frontend
uri: no://op # CRITICAL: Prevents forwarding to a backend server
predicates:
- Path=/ui
filters:
- RedirectTo=302, http://localhost:5173/
# Forward requests to backend service (OAuth2 resource server)
- id: backend-service
uri: http://localhost:8052
predicates:
- Path=/api/**
filters:
# 1. ALWAYS strip incoming spoof headers from the public web first
- RemoveRequestHeader=X-User-Id
- RemoveRequestHeader=X-User-Name
- RemoveRequestHeader=X-User-Roles
- RemoveRequestHeader=Authorization
- PrefixPath=/myservices
- TokenRelay # Add oauth (or jwt) token to request header before forwarding
security:
oauth2:
client:
provider:
platform-auth-server:
issuer-uri: http://127.0.0.1:8051
registration:
api-gateway:
provider: platform-auth-server
client-id: api-gateway
client-secret: "apiGatewayPassword1234"
client-authentication-method: client_secret_basic
authorization-grant-type: authorization_code
redirect-uri: http://localhost:5173/bff/login/oauth2/code/api-gateway
scope:
- openid
- profile
com:
c4-soft:
springaddons:
oidc:
ops:
- iss: http://127.0.0.1:8051
client:
client-uri: http://localhost:5173
login-uri: /bff/oauth2/authorization/api-gateway
security-matchers:
- /**
permit-all:
- /login/**
- /oauth2/**
- /
- /api/**
csrf: cookie-accessible-from-js
oauth2-redirections:
rp-initiated-logout: ACCEPTED
post-logout-redirect-host: http://localhost:5173
post-logout-redirect-path: /
|
