Separating OAuth2 Authorization Server and Resource Server

user_9644817 0
Viewed 3744

I implementing OAuth2 Authorization Server and Resource Server.

and there are many documents told me 'Authorization Server and Resource Server can be Separated or not'

i like MSA, so i decided Separating these Servers.

i saw many documents in Internet about this issue, but i cant proceed anymore in practice.

i'm using SpringBoot2.

  • Scenario
    1. User Connected to My Client Application.
    2. Request to secured endpoint /client/me
    3. in Client's Controller, if user has not authenticated, redirect to Authorization Server's login endpoint /auth/oauth/authorize.
    4. if user comes in my Client App first, user will sign-up(not sign-in) in my Authorization Server.
    5. in Authorization Server's sign-up page, user will input his username, realusername, password and email.
    6. user's account has issued, and user will sign-in via my Authorization Server's login form.
    7. if login succeed, Client will Request to Resource Server's /me endpoint with access-token, and Resource Server's Controller that mapped as /me will return Principal or Authentication Object as REST API.
    8. Client will bind there REST API's results into DefaultOAuth2User or CustomOAuth2User in my SecurityContext.

here is question.

As far as I know, Resource Server's /me endpoint will provide user's resources. for example, realname or email etc.

but user has signed-up in Authorization Server, so all of information are saved in Authorization Server's Database.

my oauth2 servers are MSA. so DB has been separated too.

then, how can i setting email or realname to Principal or Authentication or CustomOAuth2User Object via Resource Server's /me endpoint?

spring-security-oauth2 spring-boot oauth-2.0
1 Answers

Authorization Server is responsible for authenticating users or clients (other applications), checking if they are authorized to do what they want to do and on success, it issues a token. This means that a database it connects to should have all users credentials, clients IDs, clients secrets, roles, and other relevant information that helps in authentication and authorization.

Resource Server is responsible for handling all requests that came from frontend, be it authenticated requests or requests that are open (doesn't require authentication). Database it connects to should have information that is not relevant for authentication, like user's gender, height, weight, hobbies, etc.

To answer your question, you can create controllers in Resource Server that exposes registration, and other functionalities. This server will then make calls to Authorization Server. For registration, Resource Server will pass credentials to Auth Server to see if username is already claimed and if not register the user and based on the response of Auth Server, Resource Server will proceed with user registration. For login, frontend can make call to Auth Server directly to get token.

For all subsequent calls to protected resources (with access token) Resource Server would need to call Auth Server to verify tokens. For this Spring provides CheckTokenEndpoint (/oauth/check_token).

You can also check OAuth2RestTemplate. This can be used in Resource Server for making REST requests to Auth Server. Note that Resource Server (or any other internal application that you have like frontend) will be clients for Auth Server. They would also need to authenticate and authorize themselves.

user_28019090
Related