Http status 401 spring cloud gateway token relay - spring-security

Question

I have a spring cloud gateway service as Oauth2 client and Token Relay, which is configured with Oauth2 resource server. This setup works fine using Okta as authorization server but changing to Google, results in an HTTP 401 when the gateway tries to request the secured service. Below my configurations:
Gateway aplication.yml
server:
port: 80
spring:
application:
name: gateway-service
security:
oauth2:
client:
registration:
okta:
provider: okta
client-id: ${OKTA_OAUTH2_CLIENT_ID}
client-secret: ${OKTA_OAUTH2_CLIENT_SECRET}
authorization-grant-type: authorization_code
redirect-uri-template: "{baseUrl}/login/oauth2/code/{registrationId}"
scope: openid,profile,email
google:
provider: google
client-id: ${GOOGLE_OAUTH2_CLIENT_ID}
client-secret: ${GOOGLE_OAUTH2_CLIENT_SECRET}
authorization-grant-type: authorization_code
redirect-uri-template: "{baseUrl}/login/oauth2/code/{registrationId}"
scope: openid,profile,email
provider:
okta:
issuer-uri: <my_okta_uri>
google:
issuer-uri: https://accounts.google.com
cloud:
gateway:
routes:
- id: user
uri: lb://USER-SERVICE
predicates:
- Path=/user/**
filters:
- TokenRelay=
- RewritePath=/user(?<params>/?.*), $\{params}
- id: category
uri: lb://CATEGORY-SERVICE
predicates:
- Path=/category/**
filters:
- RewritePath=/category(?<params>/?.*), $\{params}
- id: income
uri: lb://INCOME-SERVICE
predicates:
- Path=/income/**
filters:
- RewritePath=/income(?<params>/?.*), $\{params}
- id: expense
uri: lb://EXPENSE-SERVICE
predicates:
- Path=/expense/**
filters:
- RewritePath=/expense(?<params>/?.*), $\{params}
- id: budget
uri: lb://BUDGET-SERVICE
predicates:
- Path=/budget/**
filters:
- RewritePath=/budget(?<params>/?.*), $\{params}
management:
endpoints:
web:
exposure:
include: "*"
logging:
level:
root: INFO
org:
springframework:
cloud:
gateway:
filter: TRACE
Protected service application.yml
server:
port: 8081
spring:
cloud:
loadbalancer:
ribbon:
enabled: false
application:
name: user-service
data:
mongodb:
uri: ${MONGO_URI}
security:
oauth2:
resourceserver:
jwt:
# issuer-uri: <my_okta_uri>
issuer-uri: https://accounts.google.com
management:
endpoints:
web:
exposure:
include: "*"
logging:
level:
root: INFO
org.springframework.web: INFO
org.springframework.web.HttpLogging: DEBUG
org.springframework.security: DEBUG
org.springframework.security.oauth2: DEBUG
org.springframework.cloud.gateway: DEBUG

Answer 1

I had a similar problem with Auth0. It looked like the TokenRelay filter was not passing the JWT as the Bearer token. It was providing a different access token from the OAuth2AuthorizedClient. There may be a way to provide a different OAuth2AuthorizedClient or configure this differently, but I couldn't figure it out.
However, the exchange provided to the filter was already authenticated, so it had the JWT token I wanted to send to my backend services. I think this was because my backend service endpoints were configured as authenticated:
#Bean
public SecurityWebFilterChain securityFilterChain(ServerHttpSecurity http) {
http.authorizeExchange()
.pathMatchers("/service/**").authenticated()
.pathMatchers("/**").permitAll();
http.oauth2Login();
return http.build();
}
So I wrote a custom OidcTokenRelayGatewayFilterFactory:
public class OidcTokenRelayGatewayFilterFactory extends AbstractGatewayFilterFactory<Object> {
public OidcTokenRelayGatewayFilterFactory() {
super(Object.class);
}
#Override
public String name() {
return "OidcTokenRelay";
}
#Override
public GatewayFilter apply(Object config) {
return (exchange, chain) -> exchange.getPrincipal()
.filter(principal -> principal instanceof OAuth2AuthenticationToken)
.cast(OAuth2AuthenticationToken.class)
.map(OAuth2AuthenticationToken::getPrincipal)
.filter(principal -> principal instanceof OidcUser)
.cast(OidcUser.class)
.map(token -> withOidcIdToken(exchange, token.getIdToken()))
.defaultIfEmpty(exchange).flatMap(chain::filter);
}
private ServerWebExchange withOidcIdToken(ServerWebExchange exchange, OidcIdToken accessToken) {
return exchange.mutate().request(r -> r.headers(headers -> headers.setBearerAuth(accessToken.getTokenValue())))
.build();
}
}
Then I registered a bean for the FilterFactory like how the original TokenRelayGatewayFilterFactory worked:
#Configuration(proxyBeanMethods = false)
#ConditionalOnProperty(name = "spring.cloud.gateway.enabled", matchIfMissing = true)
#ConditionalOnClass({ OAuth2AuthorizedClient.class, SecurityWebFilterChain.class, SecurityProperties.class })
#ConditionalOnEnabledFilter(OidcTokenRelayGatewayFilterFactory.class)
public class OidcTokenRelayConfiguration {
#Bean
public OidcTokenRelayGatewayFilterFactory myTokenRelayGatewayFilterFactory() {
return new OidcTokenRelayGatewayFilterFactory();
}
}
Finally, I updated my Spring configuration file to use my custom filter.
spring:
application:
name: cluster-api-gateway
cloud:
gateway:
discovery:
locator:
enabled: true
lower-case-service-id: true
filters:
- OidcTokenRelay=
- StripPrefix=2
predicates:
- Path="/service/{serviceId}/**"
With these changes, I was able to route requests to my backend services without receiving a 401 response.