111 lines
3.5 KiB
Plaintext
111 lines
3.5 KiB
Plaintext
==============================================================================
|
|
docs/output/02-five-strategies.txt
|
|
The same request into the edge service, five ways of getting a token for the hop to
|
|
downstream. Read the sub and scope of each downstream response.
|
|
GET /edge/{naive,relay,client-credentials,exchange,relay-async}
|
|
==============================================================================
|
|
|
|
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/naive
|
|
{
|
|
"strategy": "no token forwarded",
|
|
"error": "Unauthorized: 401 Unauthorized: [no body]"
|
|
}
|
|
|
|
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/relay
|
|
{
|
|
"strategy": "bearer token relayed from the incoming request",
|
|
"downstream": {
|
|
"service": "downstream:8082",
|
|
"strictValidation": false,
|
|
"sub": "alice",
|
|
"aud": [
|
|
"downstream-api"
|
|
],
|
|
"iss": "http://127.0.0.1:9000",
|
|
"scope": "[orders.write, orders.read]",
|
|
"client_id": null,
|
|
"authorities": [
|
|
"FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
|
|
"SCOPE_orders.read",
|
|
"SCOPE_orders.write"
|
|
],
|
|
"cnf": null,
|
|
"orders": [
|
|
{
|
|
"total": "42.00",
|
|
"id": 1
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/client-credentials
|
|
{
|
|
"strategy": "the edge service's own client_credentials token",
|
|
"downstream": {
|
|
"service": "downstream:8082",
|
|
"strictValidation": false,
|
|
"sub": "edge-service",
|
|
"aud": [
|
|
"downstream-api"
|
|
],
|
|
"iss": "http://127.0.0.1:9000",
|
|
"scope": "[orders.read]",
|
|
"client_id": null,
|
|
"authorities": [
|
|
"FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
|
|
"SCOPE_orders.read"
|
|
],
|
|
"cnf": null,
|
|
"orders": [
|
|
{
|
|
"total": "42.00",
|
|
"id": 1
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/exchange
|
|
{
|
|
"strategy": "RFC 8693 token exchange",
|
|
"downstream": {
|
|
"service": "downstream:8082",
|
|
"strictValidation": false,
|
|
"sub": "alice",
|
|
"aud": [
|
|
"downstream-api"
|
|
],
|
|
"iss": "http://127.0.0.1:9000",
|
|
"scope": "[orders.read]",
|
|
"client_id": null,
|
|
"authorities": [
|
|
"SCOPE_orders.read",
|
|
"FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]"
|
|
],
|
|
"cnf": null,
|
|
"orders": [
|
|
{
|
|
"total": "42.00",
|
|
"id": 1
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8081/edge/relay-async
|
|
{
|
|
"strategy": "relay attempted from a separate thread",
|
|
"error": "Unauthorized: 401 Unauthorized: [no body]"
|
|
}
|
|
|
|
# naive - 401. The control.
|
|
# relay - sub: alice, scope: [orders.write, orders.read]. The user's own
|
|
# token, unchanged, including scopes downstream did not need.
|
|
# client-creds - sub: edge-service, scope: [orders.read]. Correctly scoped, and
|
|
# the user has disappeared from downstream's audit log.
|
|
# exchange - sub: alice, scope: [orders.read]. Both. This is what RFC 8693 is
|
|
# for and it is the one nobody reaches for.
|
|
# relay-async - 401. The relay interceptor reads SecurityContextHolder, which is
|
|
# a ThreadLocal, and the call was made on a different thread.
|