Spring Security Preauthorization Filter On Zuul To Establish and Share Session

Question

I'm on a dev team working on a large scale project that uses Spring-based microservices. We've recently discovered the Spring Cloud project and are experimenting with implementing the Netflix services, Zuul, Eureka, Ribbon, etc.

In our environment, nobody will have access to the domain that our application will be running on until they have be pre-authorized through an external service. Once they reach our application, we will be able to obtain the user's identity through a header token provided by the authorization service.

I'd like to have Zuul set up with Spring Security using a preauthentication filter to establish the user's session, and use Spring Session to make the session available to all back-end microservices.

Is this a legitimate approach? The only information I can see about security on Zuul is the ability to proxy OAuth2 tokens to back-end services, but we have no need for OAuth2. Is there a better way to establish the user's session and share it across the services in our back-end architecture?

Answer 1

Please have a look at the following Tutorial

You can jump into the code on GitHub

I was able to get the project up and running, and am now in the process of modifying the in-memory authentication to use Ldap. I am new to Java and found this tutorial pretty straight forward.

Yours,

Mike Kowalski