Search code examples
spring-bootspring-securityspring-webfluxspring-security-oauth2spring-cloud-security

Spring starter security or spring cloud security How to secure an entire microservice architecture?

Currently in developer training, I am working on a personal project on spring. I started java 6 months ago, so there is a certain notion that I do not yet master. My trainer does not know spring at all, so he cannot help me. I am also French and there is very little reliable documentation on spring (it is evolving quickly). For example, I followed a French tutorial on microservices, and I used the ribbon and zuul proxy while they are currently in maintenance at spring. I started all over (new project) to recode in reactive webflux

I have several concerning spring starter security or spring cloud security

  • Spring cloud config (in connection with gitlab)
  • eureka server
  • admin server
  • gateway
  • 2 business microservices
  • 2 sub-module (model and repository)

I want all my microservices and the internal microservices (eureka, admin server, configserver) to be secure now. But I do not know how.

I want the microservice that consults config-server to identify themselves, and I also want the microservice gateway to identify itself to make requests to other microservices. Finally I want all my microservices to be protected.

Should we put spring-starter-security in microservice? Should we create a new microservice with spring-cloug-security? Should we create a new spring-cloud-security microservice and add spring-start-security everywhere?

https://cloud.spring.io/spring-cloud-security/2.2.x/reference/html/ Obviously I find this link not very explanatory

Thank you

Solution

  • In a microservice architecture that I have worked, we have always used the OAUTH2 specification for securing service.

    OAuth2 is a token-based security framework that allows a user to authenticate themselves with a third-party authentication server. If the user successfully authenticates, they will be presented with a token that must be sent with every request. The token can then be validated back to the OAuth2 Server. The OAuth2 Server is the intermediary between the application and the services being consumed. The OAuth2 Server allows the user to authenticate themselves without having to pass their user credentials down to every service the application is going to call on behalf of the user.

    Detail information for OAuth2 you can find in the following LINK .

    I have implemented simple microservice architecture for demonstrating how services are connected with each other.

    Here is the link LINK

    Below is the image representing the architecture: enter image description here