Spring Security Oauth2 SSO with Zuul Proxy

Question

I'm modifying the oauth2-vanilla sample from Springs excellent security tutorials. The oauth2-vanilla combines the Zuul Proxy and the UI into a single application. I would like to seperate the Zuul Proxy and the UI. (The Zuul Proxy should act as an API gateway and as a reverse proxy for several UIs).

When accessing the UI via the zuul proxy, it should be able to do SSO based on Oauth2 between the UI and the resource backend.

The oauth2-vanilla looks like this

Where I want to move to something like this :

I've removed the UI part from the gateway, and added a zuul route for the ui

zuul:
  routes:
    resource:
      url: http://localhost:9000
    user:
      url: http://localhost:9999/uaa/user
    ui:
      url: http://localhost:8080

I created a new UI webapp containing the UI (Angular stuff) with an @EnableOAuth2Sso annotation.

So I'm accessing the UI via http://localhost:8888 (through the zuul proxy). After authenticating and doing through the UI flow, I can access the /user endpoint that returns me the user. (During debugging, I see that when I access the /user endpoint that I have an HTTP Session with an OAuth2Authentication.

When I access the /resource endpoint however, the HttpSessionSecurityContextRepository cannot find a session and is unable to build a context with the OAuth2Authentication.

I've created a git repository with the modified sample.

I'm guessing there is something wrong with the gateway configuration. I've tried changing cookie paths, changing HttpSecurity rules in the proxy but I cannot get it to work.

What I don't understand is why the UI, when accessed through the proxy is able to resolve the /user endpoint fine (with an HTTP session and a OAuth2Authentication), but it is unable to access the /resource endpoint.

Also, as the UI is now running in the /ui context, it seems that I need to have the following code in the gateway for it to load up the angular css / js files.

.antMatchers("/ui/index.html", "/ui/home.html", "ui/css/**", "/ui/js/**").permitAll().anyRequest().authenticated();

It also doesn't seem right that I need to prefix it with the zuul ui route.

Any help would be appreciated.

Spring Security Oauth2 SSO with Zuul Proxy

1 Answers