I have a clarification question. I plan to build an authorization service with spring security and spring authorization server. Say I have multiple instances of the auth services that are behind a load balancer. My understanding is that the following will happen and assume that we have two instances A and B:
- when a user is trying to access a protected resource it will first redirect to the auth service (a request to instance A with
/oauth2/authorize?response_type=code&client_id=some_client_id&scope=some_scope&state=some_random_string&redirect_uri=http://some_redirect_url/) - the auth service will then redirect the user to login because the security filter finds out the user is not authenticated (response from instance A)
- the user will enter the credential with formLogin (at this time the request might hit instance B)
In this case, how does instance B gets all the parameters such as client_id, redirect_url, and so on?
update 1:
do I need do something like this .loginPage("/login?client_id=&client_id=some_client_id") to pass down the information