How To Implement OAuth2 Security in Microservices

spring.application.name=ehealth-central-configuration

server.port=8888

eureka.client.service-url.defaultZone=http://localhost:8761/eureka/

# available profiles of the application

spring.profiles.active=local,development,production

spring.cloud.config.server.git.uri=https://github.com/amran-bd/cloud-config

spring.cloud.config.server.git.clone-on-start=true

spring.cloud.config.server.git.search-paths=patient-management-service,ehealth-api-gateway,eureka-service-discovery,clinic-management-service

management.security.enabled=false

#To remove WAR - Could not locate PropertySource: None of labels [] found

health.config.enabled=false

# To remove I/O Issue Could not locate PropertySource: I/O error on GET request for

spring.cloud.config.enabled=false

package com.amran.central.config;

import org.springframework.boot.SpringApplication;

import org.springframework.boot.autoconfigure.SpringBootApplication;

import org.springframework.cloud.config.server.EnableConfigServer;

@EnableConfigServer

@SpringBootApplication

public class EhealthCentralConfigurationApplication {

    public static void main(String[] args) {

        SpringApplication.run(EhealthCentralConfigurationApplication.class, args);

    }

}

spring.application.name=eureka-service-discovery

spring.profiles.active=development

# ip and port of the config server

spring.cloud.config.uri=http://localhost:8888

# expose actuator endpoints

management.endpoints.web.exposure.include=refresh

management.security.enabled=false

spring.cloud.config.fail-fast=true

package com.amran.service.discovery;

import org.springframework.boot.SpringApplication;

import org.springframework.boot.autoconfigure.SpringBootApplication;

import org.springframework.cloud.netflix.eureka.server.EnableEurekaServer;

@SpringBootApplication

@EnableEurekaServer

public class EurekaServiceDiscoveryApplication {

    public static void main(String[] args) {

        SpringApplication.run(EurekaServiceDiscoveryApplication.class, args);

    }

}

#hystrix:

#  command:

#    default:

#      execution:

#        isolation:

#          thread:

#            timeoutInMilliseconds: 5000

hystrix:

  command:

    clinic-management-service:

      execution:

        isolation:

          thread:

            timeoutInMilliseconds: 5000

    patient-management-service:

      execution:

        isolation:

          thread:

            timeoutInMilliseconds: 5000

spring.application.name=ehealth-api-gateway

spring.profiles.active=development

# ip and port of the config server

spring.cloud.config.uri=http://localhost:8888

# expose actuator endpoints

management.endpoints.web.exposure.include=refresh

management.security.enabled=false

spring.cloud.config.fail-fast=true

spring.application.name=ehealth-api-gateway

server.port=8080

eureka.client.service-url.defaultZone=http://localhost:8761/eureka/

## PostgreSQL

spring.datasource.url=jdbc:postgresql://localhost:3307/ehealth-security

spring.datasource.username=postgres

spring.datasource.password=test1373

spring.datasource.type=com.zaxxer.hikari.HikariDataSource

# Hikari will use the above plus the following to setup connection pooling

spring.datasource.hikari.minimumIdle=3

spring.datasource.hikari.maximumPoolSize=500

spring.datasource.hikari.idleTimeout=30000

spring.datasource.hikari.poolName=SpringBootJPAHikariCP

spring.datasource.hikari.maxLifetime=2000000

spring.datasource.hikari.connectionTimeout=30000

spring.datasource.pool-prepared-statements=true

spring.datasource.max-open-prepared-statements=250

spring.jpa.hibernate.connection.provider_class=org.hibernate.hikaricp.internal.HikariCPConnectionProvider

spring.jpa.properties.hibernate.dialect = org.hibernate.dialect.PostgreSQL82Dialect

#Hibernate Configuration

spring.jpa.generate-ddl = true

spring.jpa.hibernate.ddl-auto=update

spring.jpa.show-sql=true

server.error.include-stacktrace=never

#feign.hystrix.enabled=true

#hystrix.shareSecurityContext=true

#All url come with prefix/api will interpret

zuul.prefix=/api

#Dynamic Service Registration in Eureka Server (API Gateway)

zuul.routes.patient-management-service.path=/patient-management-service/**

#zuul.routes.patient-management-service.url=http://localhost:8081

zuul.routes.patient-management-service.sensitive-headers

zuul.routes.patient-management-service.service-id=patient-management-service

zuul.routes.clinic-management-service.path=/clinic-management-service/**

#zuul.routes.patient-management-service.url=http://localhost:8082

zuul.routes.clinic-management-service.sensitive-headers

zuul.routes.clinic-management-service.service-id=clinic-management-service

package com.amran.api.gateway.filter;

import com.netflix.zuul.ZuulFilter;

/**

 * @Author : Amran Hosssain on 6/27/2020

 */

public class RouteFilter extends ZuulFilter {

    @Override

    public String filterType() {

        return "route";

    }

    @Override

    public int filterOrder() {

        return 1;

    }

    @Override

    public boolean shouldFilter() {

        return true;

    }

    @Override

    public Object run() {

        System.out.println("Inside Route Filter");

        return null;

    }

}

package com.amran.api.gateway;

import com.amran.api.gateway.filter.PostFilter;

import com.amran.api.gateway.filter.PreFilter;

import com.amran.api.gateway.filter.ErrorFilter;

import com.amran.api.gateway.filter.RouteFilter;

import org.springframework.boot.SpringApplication;

import org.springframework.boot.autoconfigure.SpringBootApplication;

import org.springframework.cloud.client.circuitbreaker.EnableCircuitBreaker;

import org.springframework.cloud.client.discovery.EnableDiscoveryClient;

import org.springframework.cloud.netflix.zuul.EnableZuulProxy;

import org.springframework.cloud.openfeign.EnableFeignClients;

import org.springframework.context.annotation.Bean;

@EnableFeignClients

@EnableCircuitBreaker

@EnableDiscoveryClient

@EnableZuulProxy

@SpringBootApplication

public class EhealthApiGatewayApplication {

    public static void main(String[] args) {

        SpringApplication.run(EhealthApiGatewayApplication.class, args);

    }

    @Bean

    public PreFilter preFilter() {

        return new PreFilter();

    }

    @Bean

    public PostFilter postFilter() {

        return new PostFilter();

    }

    @Bean

    public ErrorFilter errorFilter() {

        return new ErrorFilter();

    }

    @Bean

    public RouteFilter routeFilter() {

        return new RouteFilter();

    }

}

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>2.3.1.RELEASE</version>

        <relativePath/> <!-- lookup parent from repository -->

    </parent>

    <groupId>com.amran.patient.management</groupId>

    <artifactId>patient-management-service</artifactId>

    <version>0.0.1-SNAPSHOT</version>

    <name>patient-management-service</name>

    <description>patient-management-service project for Spring Boot</description>

    <properties>

        <java.version>1.8</java.version>

        <spring-cloud.version>Hoxton.SR5</spring-cloud.version>

    </properties>

    <dependencies>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-actuator</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-data-jpa</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-config-client</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-security</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.security.oauth</groupId>

            <artifactId>spring-security-oauth2</artifactId>

            <version>2.5.0.RELEASE</version>

            <scope>compile</scope>

        </dependency>

        <dependency>

            <groupId>org.postgresql</groupId>

            <artifactId>postgresql</artifactId>

            <scope>runtime</scope>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-configuration-processor</artifactId>

            <optional>true</optional>

        </dependency>

        <dependency>

            <groupId>org.projectlombok</groupId>

            <artifactId>lombok</artifactId>

            <optional>true</optional>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-test</artifactId>

            <scope>test</scope>

            <exclusions>

                <exclusion>

                    <groupId>org.junit.vintage</groupId>

                    <artifactId>junit-vintage-engine</artifactId>

                </exclusion>

            </exclusions>

        </dependency>

    </dependencies>

    <dependencyManagement>

        <dependencies>

            <dependency>

                <groupId>org.springframework.cloud</groupId>

                <artifactId>spring-cloud-dependencies</artifactId>

                <version>${spring-cloud.version}</version>

                <type>pom</type>

                <scope>import</scope>

            </dependency>

        </dependencies>

    </dependencyManagement>

    <build>

        <finalName>${project.artifactId}</finalName>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

            </plugin>

        </plugins>

        <resources>

            <resource>

                <filtering>true</filtering>

                <directory>src/main/resources</directory>

                <includes>

                    <include>*.properties</include>

                </includes>

            </resource>

        </resources>

    </build>

</project>

server.url = Patient Management Service Working...

spring.application.name=patient-management-service

spring.profiles.active=development

# ip and port of the config server where we can get our central configuration.

spring.cloud.config.uri=http://localhost:8888

# expose actuator endpoints

management.endpoints.web.exposure.include=refresh

management.security.enabled=false

spring.cloud.config.fail-fast=true

##Security parameter for request verification ##

#we consider basic authorization and Token. In auth server verified this token generated by authorization server (Self) based below criteria. 

client_id=kidclient

client_credential = kidsecret

check_authorization_url = http://localhost:8080/oauth/check_token

resources_id = ehealth

package com.amran.patient.management;

import org.springframework.boot.SpringApplication;

import org.springframework.boot.autoconfigure.SpringBootApplication;

import org.springframework.cloud.client.discovery.EnableDiscoveryClient;

@EnableDiscoveryClient

@SpringBootApplication

public class PatientManagementServiceApplication {

    public static void main(String[] args) {

        SpringApplication.run(PatientManagementServiceApplication.class, args);

    }

}

package com.amran.patient.management.security;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.context.annotation.Configuration;

import org.springframework.http.HttpMethod;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;

import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;

import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;

/**

 * @Author : Amran Hosssain on 6/27/2020

 */

@Configuration

@EnableResourceServer

public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Value("${resources_id}")

    private String resourceId;

    @Override

    public void configure(HttpSecurity http) throws Exception {

        http

                .headers().frameOptions().disable()

                .and()

                .csrf().disable()

                .authorizeRequests()

                .antMatchers("/eureka/**").permitAll()

                .anyRequest()

                .authenticated();

    }

    @Override

    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {

        resources.resourceId(resourceId);

    }

}

package com.amran.patient.management.security;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager;

import org.springframework.security.oauth2.provider.token.RemoteTokenServices;

import org.springframework.security.oauth2.provider.token.ResourceServerTokenServices;

/**

 * @Author : Amran Hosssain on 6/27/2020

 */

@Configuration

@EnableWebSecurity

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${client_id}")

    private String clientId;

    @Value("${client_credential}")

    private String clientSecret;

    @Value("${check_authorization_url}")

    private String checkAuthUrl;

    @Bean

    public ResourceServerTokenServices tokenServices() {

        RemoteTokenServices tokenServices = new RemoteTokenServices();

        tokenServices.setClientId(clientId);

        tokenServices.setClientSecret(clientSecret);

        tokenServices.setCheckTokenEndpointUrl(checkAuthUrl);

        return tokenServices;

    }

    @Override

    public AuthenticationManager authenticationManagerBean() throws Exception {

        OAuth2AuthenticationManager authenticationManager = new OAuth2AuthenticationManager();

        authenticationManager.setTokenServices(tokenServices());

        return authenticationManager;

    }

}