Configure OAuth 2.0 Security

OAuth 2.0 is an authorization framework that uses authorization tokens to access HTTP resources. OAuth 2.0 can be used to check if a client can access RS Gateway in a distributed system by passing signed tokens with every request. Configure OAuth 2.0 security to enable single sign-on with an authorization server.

Before you begin

You must configure the authorization server with the users and get the token.

Procedure

  1. Edit the rsgateway-site.yaml file and configure RS Gateway with the authorization server URI for OAuth 2.0: 
    spring:
   security:
     oauth2:
       resourceserver:
         jwt:
           issuer-uri: https://host-uri

    Replace https://host-uri with the host URI of the authorization server.

  2. (Optional) In the rsgateway-site.yaml file, specify the key that includes any roles associated with the user. 
    mtx:
  oauth2:
    roles-converter:
      json-ptr-expr: /key
    Replace key with the name of an array of roles (for example, groups). The following array is an example from an authorization token.
    "groups": [
    "RSG_READ",
    "Everyone",
    "RSG_CREATE",
    "RSG_DEBUG"
  ]

    These roles are merged with any roles configured in rsgateway_users.yaml and then all roles are authenticated.

  3. (Optional) Use the value for the principal-claim-name field passed in the token instead of the sub field as the username.
    Set the principal-claim-name to jti as shown here.
    mtx:
  oauth2:
    roles-converter:
      json-ptr-expr: /key
      principal-claim-name: jti
    In the JSON Web Token (JWT), set the jti value as shown below.
    {
  "sub": "[email protected]",
  "aud": "rsgateway",
  "nbf": 1644847530,
  "iss": "http://localhost:9595/",
  "groups": [
    "RSG_READ",
    "RSG_WRITE",
    "RSG_DEBUG"
  ],
  "exp": 1644933680,
  "jti": "value"
}

    For example, set "jti": "05fabd80-afc7-4636-b11e-ad948392c347".

  4. Include the access token in the Authorization Bearer header to include it in requests: 
    Authorization: Bearer access_token

    Replace access_token with the access token from the authorization server.

    For example, when using curl:
    curl --request GET \
  --url http://localhost:9090/api/rsgateway/create \
  --header 'Authorization: Bearer eyJraWQiOiI1NTVPZ2EtSDRnUDQyTTN...