Add the service-to-service module

service-to-service/docs/output/02-five-strategies.txt

@@ -0,0 +1,110 @@
+==============================================================================
+docs/output/02-five-strategies.txt
+The same request into the edge service, five ways of getting a token for the hop to
+downstream. Read the sub and scope of each downstream response.
+GET /edge/{naive,relay,client-credentials,exchange,relay-async}
+==============================================================================
+
+$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/naive
+{
+    "strategy": "no token forwarded",
+    "error": "Unauthorized: 401 Unauthorized: [no body]"
+}
+
+$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/relay
+{
+    "strategy": "bearer token relayed from the incoming request",
+    "downstream": {
+        "service": "downstream:8082",
+        "strictValidation": false,
+        "sub": "alice",
+        "aud": [
+            "downstream-api"
+        ],
+        "iss": "http://127.0.0.1:9000",
+        "scope": "[orders.write, orders.read]",
+        "client_id": null,
+        "authorities": [
+            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
+            "SCOPE_orders.read",
+            "SCOPE_orders.write"
+        ],
+        "cnf": null,
+        "orders": [
+            {
+                "total": "42.00",
+                "id": 1
+            }
+        ]
+    }
+}
+
+$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/client-credentials
+{
+    "strategy": "the edge service's own client_credentials token",
+    "downstream": {
+        "service": "downstream:8082",
+        "strictValidation": false,
+        "sub": "edge-service",
+        "aud": [
+            "downstream-api"
+        ],
+        "iss": "http://127.0.0.1:9000",
+        "scope": "[orders.read]",
+        "client_id": null,
+        "authorities": [
+            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
+            "SCOPE_orders.read"
+        ],
+        "cnf": null,
+        "orders": [
+            {
+                "total": "42.00",
+                "id": 1
+            }
+        ]
+    }
+}
+
+$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/exchange
+{
+    "strategy": "RFC 8693 token exchange",
+    "downstream": {
+        "service": "downstream:8082",
+        "strictValidation": false,
+        "sub": "alice",
+        "aud": [
+            "downstream-api"
+        ],
+        "iss": "http://127.0.0.1:9000",
+        "scope": "[orders.read]",
+        "client_id": null,
+        "authorities": [
+            "SCOPE_orders.read",
+            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]"
+        ],
+        "cnf": null,
+        "orders": [
+            {
+                "total": "42.00",
+                "id": 1
+            }
+        ]
+    }
+}
+
+$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/relay-async
+{
+    "strategy": "relay attempted from a separate thread",
+    "error": "Unauthorized: 401 Unauthorized: [no body]"
+}
+
+# naive           - 401. The control.
+# relay           - sub: alice, scope: [orders.write, orders.read]. The user's own
+#                   token, unchanged, including scopes downstream did not need.
+# client-creds    - sub: edge-service, scope: [orders.read]. Correctly scoped, and
+#                   the user has disappeared from downstream's audit log.
+# exchange        - sub: alice, scope: [orders.read]. Both. This is what RFC 8693 is
+#                   for and it is the one nobody reaches for.
+# relay-async     - 401. The relay interceptor reads SecurityContextHolder, which is
+#                   a ThreadLocal, and the call was made on a different thread.