Add the service-to-service module

service-to-service/docs/output/04-gateway-token-relay.txt

@@ -0,0 +1,80 @@
+==============================================================================
+docs/output/04-gateway-token-relay.txt
+Spring Cloud Gateway Server MVC with 'filters: - TokenRelay='.
+GET /edge/relay through the gateway on 8080.
+==============================================================================
+
+$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8080/edge/relay
+HTTP/1.1 200 
+cache-control: no-cache, no-store, max-age=0, must-revalidate
+expires: 0
+pragma: no-cache
+x-content-type-options: nosniff
+x-frame-options: DENY
+x-xss-protection: 0
+Content-Type: application/json
+
+{
+    "strategy": "bearer token relayed from the incoming request",
+    "downstream": {
+        "service": "downstream:8082",
+        "strictValidation": false,
+        "sub": "alice",
+        "aud": [
+            "downstream-api"
+        ],
+        "iss": "http://127.0.0.1:9000",
+        "scope": "[orders.write, orders.read]",
+        "client_id": null,
+        "authorities": [
+            "SCOPE_orders.read",
+            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
+            "SCOPE_orders.write"
+        ],
+        "cnf": null,
+        "orders": [
+            {
+                "total": "42.00",
+                "id": 1
+            }
+        ]
+    }
+}
+
+$ curl 127.0.0.1:8080/edge/relay          # no Authorization header at all
+status 401
+
+# and the identical route with the TokenRelay filter REMOVED:
+$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8080/norelay/x
+{
+    "strategy": "bearer token relayed from the incoming request",
+    "downstream": {
+        "service": "downstream:8082",
+        "strictValidation": false,
+        "sub": "alice",
+        "aud": [
+            "downstream-api"
+        ],
+        "iss": "http://127.0.0.1:9000",
+        "scope": "[orders.write, orders.read]",
+        "client_id": null,
+        "authorities": [
+            "SCOPE_orders.read",
+            "FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
+            "SCOPE_orders.write"
+        ],
+        "cnf": null,
+        "orders": [
+            {
+                "total": "42.00",
+                "id": 1
+            }
+        ]
+    }
+}
+
+# TokenRelay relays the access token of the currently authenticated USER - the one
+# obtained by oauth2Login(). This gateway has no oauth2Login, so there is no
+# authorized client to read a token from, and the filter contributes nothing. What
+# reaches the edge service is whatever Authorization header the caller sent, because
+# the gateway proxied it. TokenRelay is not 'forward the incoming bearer token'.