Can't find OAuth2RestTemplate when relay OAuth2 JWT token between resource servers. about spring-cloud-security

[jaggerwang]

I tried to relay Authorization header by my self using the following ClientHttpRequestInterceptor:

package net.jaggerwang.scip.common.api.interceptor;

import org.springframework.http.HttpRequest;
import org.springframework.http.client.ClientHttpRequestExecution;
import org.springframework.http.client.ClientHttpRequestInterceptor;
import org.springframework.http.client.ClientHttpResponse;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import java.io.IOException;

public class OAuth2TokenRelayInterceptor implements ClientHttpRequestInterceptor {
    @Override
    public ClientHttpResponse intercept(HttpRequest request, byte[] body, ClientHttpRequestExecution execution) throws IOException {
        var requestAttrs = RequestContextHolder.getRequestAttributes();
        if (requestAttrs instanceof ServletRequestAttributes) {
            var servletRequestAttrs = (ServletRequestAttributes) requestAttrs;
            var authHeader = servletRequestAttrs.getRequest().getHeader("Authorization");
            if (authHeader != null) {
                request.getHeaders().add("Authorization", authHeader);
            }
        }
        return execution.execute(request, body);
    }
}

package net.jaggerwang.scip.user.api.config;

...

@Configuration(proxyBeanMethods = false)
public class ServiceConfig {
    ...

    private RestTemplate restTemplate(RestTemplateBuilder builder, String rootUri) {
        var restTemplate = builder.rootUri(rootUri).build();

        var interceptors = restTemplate.getInterceptors();
        if (CollectionUtils.isEmpty(interceptors)) {
            interceptors = new ArrayList<>();
        }
        interceptors.add(new OAuth2TokenRelayInterceptor());
        restTemplate.setInterceptors(interceptors);

        return restTemplate;
    }

    ...
}

But the attrs returned by RequestContextHolder.getRequestAttributes is always null, because the request executed by RestTemplate is in a child thread. I also tried to customize the RequestContextListener to be inheritable as the following, but it still the same result.

package net.jaggerwang.scip.common.api.listener;

import org.springframework.context.i18n.LocaleContextHolder;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.RequestContextListener;
import org.springframework.web.context.request.ServletRequestAttributes;

import javax.servlet.ServletRequestEvent;
import javax.servlet.http.HttpServletRequest;

public class InheritableRequestContextListener extends RequestContextListener {
    private static final String REQUEST_ATTRIBUTES_ATTRIBUTE =
            RequestContextListener.class.getName() + ".REQUEST_ATTRIBUTES";

    @Override
    public void requestInitialized(ServletRequestEvent requestEvent) {
        if (!(requestEvent.getServletRequest() instanceof HttpServletRequest)) {
            throw new IllegalArgumentException(
                    "Request is not an HttpServletRequest: " + requestEvent.getServletRequest());
        }
        HttpServletRequest request = (HttpServletRequest) requestEvent.getServletRequest();
        ServletRequestAttributes attributes = new ServletRequestAttributes(request);
        request.setAttribute(REQUEST_ATTRIBUTES_ATTRIBUTE, attributes);
        LocaleContextHolder.setLocale(request.getLocale());
        // Set attributes inheritable
        RequestContextHolder.setRequestAttributes(attributes, true);
    }
}

[jaggerwang]

Right now I'm using request scope bean to avoid using RequestContextHolder, but it will create service object for every request.

    @Bean
    @RequestScope
    public FileSyncService fileSyncService(@Qualifier("fileServiceRestTemplate") RestTemplate restTemplate,
                                           CircuitBreakerFactory cbFactory,
                                           ObjectMapper objectMapper,
                                           HttpServletRequest request) {
        return new FileSyncServiceImpl(restTemplate, cbFactory, objectMapper, request);
    }

[artemoons]

Hello, I use the same scenario of communication between Client and two RS but as for today I use the latest RS's from Spring Security 5 and Bearer tokens. The docs here about token relay I bit outdated I think so it's wasn't working in my case.

there is no OAuth2RestTemplate and UserInfoRestTemplateFactory

When I tried to request RS2, I got 401 error message in RS1. To fix it, I added header with bearer token (from Principal) when sending request to RS2 and it worked. Now I'm in progress of searching how to add this header by default for all requests from my RS1 to RS2.

Just shared some of my experience as per today :-)

[ryanjbaxter]

I dont see what this has to do with Spring Cloud Security. It seems to be a Spring Security issue/question. If I am wrong please explain where Spring Cloud Security comes into play.