I am authenticating against an OAuth2 service that provides me 3 endpoints:
http://bobsoauth.com/oauth2/authorize
http://bobsoauth.com/oauth2/token
http://bobsoauth.com/oauth2/userdata
This service DOES NOT issue JWTs.
I need to use an Angular client application, connecting to a Spring Cloud Gateway, which in turn connects to multiple Spring Boot microservices.
Without JWTs, can I still use a token relay setup between the gateway and the microservices?
Without JWTs, you'll have to configure your resource-servers with token introspection (http.oauth2ResourceServer().opaqueToken() instead of http.oauth2ResourceServer().jwt() in spring-security conf). This is far less efficient than JWT decoding because each micro-service has to submit token to authorization-server for each and every request it processes.
Sample here: https://github.com/ch4mpy/spring-addons/tree/master/samples/tutorials/resource-server_with_introspection
The endpoint is usually called introspect, but I guess you'll have to figure out a way to use userdata in your case.
Have your Angular application authenticate against your authorization-server, and use the gateway just to forward Authorization header.
For Angular, I use angular-auth-oidc-client. Just put in the conf the URLs you mentioned in your question.
