Spring Boot Microservices Project Example - Part 5 | Security

Spring Boot Microservices Project Example - Part 5 | Security
Source Code
github.com/Sai...
⭐️⭐️ You can follow me on Social Media through the below Links⭐️⭐️
Twitter: / sai90_u
Blog: programmingtec...
Dev.to: dev.to/saiupad...
Facebook Page: / programmingtechie

[@ProgrammingTechie]

This tutorial is using outdated as it's using Spring Boot 2, Refer to the updated version of the tutorial here - kzbin.info/www/bejne/r5_CpKePaK12qJo

[@techlead_ashu]

yeah man, i just completed your Key-Cloak course using Spring Boot 3. Just for this!

[@tzhynt]

There are no words to show my appreciation. Thank you from the bottom of my heart for everything.

[@TungNguyen-jc8rx]

May I ask a question? If I want to get curent user logged in information (id, name, roles....) in order-serivce, how can I handle it? Many thanks

[@Qqbroski]

God bless you my friend!

[@Qqbroski]

Maybe one day you could make a "production-ready" back-end behind a paywall, I would pay big dollars for that!

[@az910]

Next part please :)

[@dreevo4537]

Haven't you setup the security filter chain to permit all requests to /eureka/** ? doesn't that mean that when we access localhost:8080/eureka/web we will be authorized without an access token. I'm a bit confused.

[@sitalsitoula6536]

I could access without any token.

[@sayikumar9230]

Yes, the discovery service doesn't need any extra authentication to be set up. It can be accessed just by adding permit all feature to URI "/eureka/**" in gateway service as shown in mid section of the video. Thanks a lot to the creator of the video. It helped me to understand the MS concept well with latest spring boot versions

[@arek9430]

Seems like in api-gateway he allowed '/eureka/** ' (which resulted in free access to this resource), but then inside the discovery-server he protected it with httpBasic - which resulted in turn that in order for other microservices to be registered to this discovery-server, they had to provide username:password credentials.

[@TheMakeupmonika]

Hi Programming Techie, first of all I would like to thank you so much for your time and the great content you present on your chanel. Thank you so so much ! !!! l am facing some issue right now , could you please help me with solving the problem ????? How to solve the problem , Everything looks greate , but when I log in to the eureka server from the browser , the eureka server console/gui runs but there is no instance at all , instance of my microservices that have been registrerd. Thank you very much for any advice and help

[@pratikmondal9301]

you missed spring cloud dependency in the client module

[@arek9430]

Question: If someone wants to access microservice through API gateway - it is protected. But if someone wants to access microservice by its original port number, then its not protected at all. Shouldn't it all be protected?

[@ProgrammingTechie]

Ideally yes but I didn't get into that detail in this tutorial

[@arek9430]

@@ProgrammingTechie Thanks for time and answer. But how would you protect these original ports in that case?

[@ProgrammingTechie]

​@@arek9430I covered this in my previous Microservices tutorial - kzbin.info/www/bejne/pHjGh614gs94fck Basically, we secure the other services as resource servers and pass the token from API Gateway to the microservices, this is called as Token Relay.

[@bulbul-dev]

How can I manage Custom user service

[@pradhidas]

How to resolve deprecated methods of serverHttpSecurity: 'csrf()' is deprecated and marked for removal and 'jwt()' is deprecated and marked for removal? In this line of code: serverHttpSecurity.csrf() .disable() .authorizeExchange(exchange -> exchange .pathMatchers("/eureka/**") .permitAll() .anyExchange() .authenticated()) .oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::jwt);

[@SdwHoussamEddine]

I did this serverHttpSecurity.csrf(csrf -> csrf.disable()) .authorizeExchange(exchange -> exchange .pathMatchers("/eureka/**") .permitAll() .anyExchange() .authenticated()) .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));

[@pradhidas]

@@SdwHoussamEddine Thank you, that worked! :) Could you also help me out with the deprecated functions here? (withDefaultPasswordEncoder and authorizeRequests seem to be deprecated and are not working as desired) public class SecurityConfig { @Bean public InMemoryUserDetailsManager userDetailsService() { UserDetails user = User.withDefaultPasswordEncoder() .username("eureka") .password("password") .roles("USER") .authorities("USER") .build(); return new InMemoryUserDetailsManager(user); } @Bean public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception { httpSecurity.csrf(Customizer.withDefaults()) .authorizeRequests() .anyRequest() .authenticated() .and() .httpBasic(Customizer.withDefaults()); return httpSecurity.build(); } }

[@g.gnanaseelan3651]

@@pradhidas have you fixed the deprecated issue?

[@an0784]

Hi, thank you for such a great series. Have a query , how do we get user information in the microservice itself, for example if order-service has to list orders raised by the current user who is accessing the service . Another case when some actions of order service needs a specific permission on the user ( eg a support person doing privileged action on an order) .

[@SnehaishChakrabortyLive]

Hi. Just wanted to understand why the discovery service threw 401 error. Because we set antmather of /eureka/** to be permitall(). I was following along and for me I was able to access the eureka server without authentication while the other services were behind authentication.

[@hoangang6586]

i have the same question, Anyone could explain this? thanks

[@hamzabouzidi470]

@@hoangang6586 I have the same problem, did you fix it?

[@hamzabouzidi470]

the same problem did you fix it?

[@khoa-hd]

the same problem here

[@Likrant]

you have to use eureka.client.service-url.defaultZone instead of eureka.client.service-url.default-zone

[@shwetabhat9981]

Thank you sir !! It's just amazing and so simplistic to understand 🙂

[@jerffesongomes9352]

If I try access the service order directly, will it open? You dont set any security config in order servicer or product servecer

[@kazimirbortnik371]

hello, please tell me when will the continuation of your lessons, I look forward to

[@josearmin]

What will happen if you directly call the endpoints from the services and not via the gateway?

[@thomasandolf7365]

For anyone using this tutorial in 2024, the tutorials dependencies are broken, the versions of spring are old, and we have had several people following this tutorial, that later has asked questions on stack overflow how to fix this. This tutorial should be either updated to reflect current versions as the versions used here are over one and a half years old, or should be removed as it does more harm than good.

[@ProgrammingTechie]

Thanks for your comment, the update of the tutorial is already planned, I already updated the Github code sometime back with the latest changes, so that people are not lost, I added a pinned comment to make this point clear.

[@daniellaerachannel]

when the version with spring boot 3 and security 6 ? thanks

[@CodeSpell]

Gratitude .. Thanks for creating this genius content.

[@devmail4648]

Great work thanks alot...please can you update the OAuth2 security config and basic Auth...its giving me errors, since some of the methods are deprecated...I have tried to correct the errors but not successful. Thank you

[@stpunk47]

Hi ! To resolve the deprecation warnings in your Spring Boot application for CSRF and JWT configurations, you can update your bean as follows: Replace .csrf().disable() with .csrf(ServerHttpSecurity.CsrfSpec::disable) for the CSRF configuration. Replace .oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::jwt) with .oauth2ResourceServer(oauth2ResourceServer -> oauth2ResourceServer.jwt(jwt -> {})) for the JWT configuration.

[@azharmobeen]

Thank you soo much this series of tutorials, just one quick question, you have by pass /eureka/** then why we need basic auth for browser ? If I'm not wrong you have added spring-security in api-gatway module and discovery service should not be impated because we by pass in gatway config.

[@tranhuy216]

same question, probably shouldn't be bypassing discovery server

[@tranhuy216]

same question, probably shouldn't be bypassing discovery server

[@faixan13]

for me , its bypassing successfully. I didn't get error with latest boot 3 and spring 6 configuration when try to load localhost:8080/eureka/web

[@abdulalsowdh3497]

I have one error Cannot run on unknown server after using user name and password What can i do

[@stefancolic838]

Hi, I am getting the same error, have you resolved it?

[@konstantingromov6485]

Hi, great video as usual. I have a question - is it an option to use api-gateway as client instead with TokenRelay setting? Cause usually resource server is a target point and gateway itself does not provide resource - it just routing to others resource services. Or it's implemented in this way in scope of series since we are using Postman as a client and client_credentials flow?

[@nestora.a.3465]

Some of the the functions of the api-gateway includes parameter validation, allow/deny list, authentication and authorization, rate-limiting, dynamic routing and so on. From a typical architectural diagram indicating how a request flows in an api-gateway shows why it is favorable to implement security in this layer

[@prog_ramming_brains]

hello sir,when is the next video?

[@manjosh1990]

Very good video, helps me a lot at work. Can you also make a video on enabling CSRF in spring cloud gateway.

[@toto_frs620]

Hi Sai. Good video! Is it possible to implement registration and login with Keycloak without using the GUI (Something like the video on the JWT)? Thanks in advance

[@ProgrammingTechie]

Hi I don't understand, if you don't use GUI then you won't do any registration as the user will use the client I'd and client secret to get the token

[@toto_frs620]

​@@ProgrammingTechie Sorry, let me explain better. When you made the playlist on keycloak, if I have not misunderstood you have created a new user via the Keycloak admin interface. So the question is, how can an external user do a registration? For example in the project "Reddit clone" a new user called "api/signup" to register. (Sorry for any grammar errors, I don't speak English)

[@ProgrammingTechie]

@@toto_frs620 You can enable the user registration option in keycloak, by going to your Realm settings -> Login -> User Registration and enable that checkbox, then when you try to access login page it will show you a login screen with option to register.

[@RexpecT_]

@@ProgrammingTechie User registration and login via own REST api would be a neat solution. In that case, the application can store client id and secret privately, and we don't rely on keycloak login/registration user interface.

[@cuzzamlkral372]

@@RexpecT_ Exactly

[@ChandlerBing11]

Such a great content! Thank you so much

[@QuickInterviewPrep]

Great tutorial :). I can see authentication implemented using key cloak. How do i implement role based authorization in my micro services?

[@abdulalsowdh3497]

Anyone help me

[@abderrahmenhelaoui6511]

if is it possible, i think it's highly recommended to implement a front End side by using Angular for example

[@ProgrammingTechie]

I already have tutorials on how to do this, check out my keycloak tutorial and KZbin clone tutorial

[@abderrahmenhelaoui6511]

@@ProgrammingTechie thanks a lot, but I mean for all the microservices project, not only the key lock part

[@testingdave7629]

Hi. How about registration of user? I am planning to add an endpoint wherein I can call on my frontend and add a user

[@bathientran9074]

What Frontend Framework Do you use for this course ?

[@quanphan7337]

video đầu tiên có nói kìa cha, coi tua à

[@manho9682]

I don't know why euraka dashboard sill access normally at 19:28, what i missed?

[@tomekwierzbicki5757]

I don't understand why did u get 401 in 19:40 min - when calling eureka using api-gateway. In my configuration everything works in different way- i mean that my eureka allways returns data- no 401. The main difference is im using spring boot 3.. and spring 6.. vaersions. If any1 would like to help me understanding this i would be gratefull.

[@faixan13]

I faced the same means no error at all. Discovery loads perfectly, and also it should not be authenticated as per config code. So its working fine :D

[@leminhos8142]

You deserve more recognition, love this content

[@ionguzun3952]

can u do a updated video?

[@andrew-xu3vw]

I have followed the video but user and password that is set in configuration is simply ignored, and Spring security generates password and sets the user to User. Probably somthing is missing or reason is that we extend the deprecated class. Has anyone resolved that?

[@yananchen7648]

Same here. Many methods in this part are deprecated...

[@sebastiansilvavidal452]

what do I do if I stop the process and the next day I continue but localhost:8181 does not show keyclock admin console, I rerun docker and everything was deleted (the realm, the client, so I can not get the token when creating an order in postman)

[@ProgrammingTechie]

Unfortunately at this stage you have to recreate the realm, client, etc. You can run a docker container of keycloak, export the realm and mount that realm while running the docker container, that's what I did in the dockerize video (part -9)

[@eminothedon716]

hello thanks for the tutorial i'm wondering why you used WebFluxSecurity instead of the regular EnableWebsecurity?

[@ProgrammingTechie]

Spring Cloud Gateway is built on top of Spring Webflux instead of Spring MVC. EnableWebSecurity - used when working with Spring MVC. EnableWebFluxSecurity - used when working with Spring Web Flux

[@maneshipocrates2264]

Hi. Did you finally continue the series with 8 - kafka?

[@bharathmaddineni3186]

Thank you so much! Where exactly should I write thyme leaf UI code in the architecture you explained? Should be another microservice accessed via api/ui/***? or inside api gateway?

[@ProgrammingTechie]

Yes you can use API Gateway to maintain the Thymeleaf code. Then the API Gateway should be configured as an OAuth2 Clinet instead of Resource Server

[@prasannasippa5962]

getting error for websecurityconfigureradapter please help

[@defrankline]

Thanks bro.!

[@manee427]

Great contetnt

[@az910]

Best ✨

[@anouardehilis5976]

Thank you, do you have an update for this course according to spring security 6

[@ProgrammingTechie]

Check the GitHub code, it's updated

[@lucatrubbiani2104]

hello, I'm trying to configure eureka with the basic auth. Following the video step by step. I get this error while trying to register all the services. Request execution failure with status code 401; retrying on another server if available The zone is configured correctly! I also added the user and password on the uri! Any help? Thanks all

[@felipev5607]

same issue, my error was I created the config package outside in the wrong place, I just moved it and works

[@lucatrubbiani2104]

@@felipev5607 Did u have also problem with cors? Because trying to create a front-end application that call a microservices I'm stuck. It work when I use postman not if api is called from angular app. According to doc to enable cors is enough to put those properties into api-gateway application.properties spring.cloud.gateway.globalcors.add-to-simple-url-handler-mapping=true spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowedOrigins=* spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowedHeaders=* spring.cloud.gateway.globalcors.corsConfigurations.[/**].allowedMethods=* the (*) symbol is not showed...but is after any configuration option. No luck! any ideas?

[@Likrant]

you have to use eureka.client.service-url.defaultZone instead of eureka.client.service-url.default-zone

[@nehemiahlimocheburet1411]

How can I get the architectural diagram?

[@shashidharnmrec]

sir i love you as you provided good material

[@srinuseenu1278]

Hi bro I'm using MacBook Pro after creating spring-cloud-client I'm not getting access type as bearer or confidential. Its showing empty fields in spring-cloud-client settings can you help me to resolve the issue?

[@ProgrammingTechie]

Hi, can you tell me which keycloak version you are using ?I suspect it may be a change with the new version

[@srinuseenu1278]

@@ProgrammingTechie I'm using 19.0.2 version

[@srinuseenu1278]

@@ProgrammingTechie can you resolve and help me

[@observer861]

can't get past 401 in Postman 😢

[@marekstarzycki4131]

did u manage to solve it?

[@observer861]

@marekstarzycki4131 No, but I was doing different stuff. I need to get back to it this weekend. Wanna have a look, maybe?

[@ГригорийОбразцов-э5о]

Hi! Can you show how this project can be placed on docker swarm + portainer?Since it will be cheaper and easier to do on vps server.

[@ProgrammingTechie]

Hi, I am planning to use Kubernetes for this.

[@gauravsrivastava3884]

@@ProgrammingTechie May I know if you are working on the next video of this series or has it been put on hold? Thanks !

[@nizamsarder]

athorization ?

[@kazimirbortnik371]

Dear friend! How are you? Could you please tell when you are going to post new video?

[@ProgrammingTechie]

Hi I will post the video this Saturday

[@kazimirbortnik371]

@@ProgrammingTechie looking forward to)

[@AwonerMayank]

@@ProgrammingTechie Bro .. Saturday was yesterday :p . . eagerly waiting for the next one.

[@ProgrammingTechie]

@@AwonerMayank The video is almost ready I am adding some additional information, I will release by EOD today :)

[@AwonerMayank]

@@ProgrammingTechie Thanks a lot bro :)

[@shekharchoudhari920]

Hi, awesome stuff but, for keycloack purpose I was implementing oauth2 and found that security configuration is deprecated with jwt and even all possible combinations are not working with it , could you help?

[@Nerddog12344]

just check spring security 6 documentation

[@faixan13]

.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults())); I did this. its working fine for me.

[@sudiprana800]

Hello Sir. Can you please clarify one doubt for me i.e I was unable to login to eureka dashboard using properties : eureka.username=${EUREKA_USERNAME:eureka} eureka.password=${EUREKA_PASSWORD:password} Instead I had to use this : spring.security.user.name=admin spring.security.user.password=admin

[@marwenghannem2193]

I have the same problem :/ any solution

[@sudiprana800]

@@marwenghannem2193 Greetings, Actually for me the issue was soemthing else. Later on I realised that the security config package that I had created wasn't under the root package due to which request were not going through.

[@viettran1813]

Oh wow. Got the same problem and solved by what @Sudip Rana found. Move the config file to the correct place.

[@sudiprana800]

@@viettran1813 Great to hear 😇

[@baranemreturkmen9497]

@@sudiprana800 You're a life saver man! Thanks. Great observation. But I can't understand that why this solution worked for us. Is there any one explain us to logic of the solution?