{"action":"created","issue":{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/issues/796","labels_url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/issues/796/labels{/name}","comments_url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/issues/796/comments","events_url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/issues/796/events","html_url":"https://github.com/spring-cloud/spring-cloud-netflix/issues/796","id":129279880,"number":796,"title":"Zuul Server with @EnableOAuth2Sso to proxy service with @EnableOAuth2Resource","user":{"login":"raphsoft","id":8571102,"avatar_url":"https://avatars.githubusercontent.com/u/8571102?v=3","gravatar_id":"","url":"https://api.github.com/users/raphsoft","html_url":"https://github.com/raphsoft","followers_url":"https://api.github.com/users/raphsoft/followers","following_url":"https://api.github.com/users/raphsoft/following{/other_user}","gists_url":"https://api.github.com/users/raphsoft/gists{/gist_id}","starred_url":"https://api.github.com/users/raphsoft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raphsoft/subscriptions","organizations_url":"https://api.github.com/users/raphsoft/orgs","repos_url":"https://api.github.com/users/raphsoft/repos","events_url":"https://api.github.com/users/raphsoft/events{/privacy}","received_events_url":"https://api.github.com/users/raphsoft/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/labels/question","name":"question","color":"cc317c"},{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/labels/waiting%20for%20feedback","name":"waiting for feedback","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-27T21:49:25Z","updated_at":"2016-02-01T15:40:09Z","closed_at":null,"body":"I would appreciate your comments regarding this question:\r\n\r\nI do have an spring-boot application annotated with @EnableZuulProxy which is intended to be our edge server and should proxy request to our backend spring-boot rest services. So as I understand, Zuul will automatically relay the token if the @EnableOAuth2Sso annotation is present. \r\n\r\nSo we also have everything running in Cloud Foundry and actually the Zuul server with OAuth2 works fine: it redirects you to our SSO Login when the user is not authenticated and is able to respond non-proxied request (for instance: environment information in the /env path provided by actuator).\r\n\r\nThen I go to my backend service and set values for the spring.oauth2.client.* properties with the same as those for the Zuul server:\r\n\r\n```\r\nspring:\r\n  oauth2:\r\n    client:\r\n      clientId: id_from_zuul\r\n      clientSecret: secret_from_zuul\r\n      accessTokenUri: https://sso.login.myorg.com/oauth/token\r\n      userAuthorizationUri: https://sso.login.myorg.com/oauth/authorize\r\n      clientAuthenticationScheme: header\r\n    resource:\r\n      userInfoUri: https://sso.login.myorg.com/userinfo\r\n      preferTokenInfo: false\r\n```\r\n\r\nAlso, I add the @EnableOAuth2Resource annotation to my spring-boot backend service and add the  configuration for the XSRF Token:\r\n\r\n```\r\n@SpringBootApplication\r\n@EnableEurekaClient\r\n@EnableOAuth2Resource\r\npublic class CacheApplication extends WebSecurityConfigurerAdapter {\r\n\r\n    public static void main(String[] args) {\r\n        if (\"true\".equals(System.getenv(\"SKIP_SSL_VALIDATION\"))) {\r\n            SSLValidationDisabler.disableSSLValidation();\r\n        }\r\n        SpringApplication.run(CacheApplication.class, args);\r\n    }\r\n\r\n\r\n    @Override\r\n    protected void configure(HttpSecurity http) throws Exception {\r\n        http.antMatcher(\"/**\").authorizeRequests().anyRequest()\r\n                .authenticated().and().csrf()\r\n                .csrfTokenRepository(csrfTokenRepository()).and()\r\n                .addFilterAfter(csrfHeaderFilter(), CsrfFilter.class);\r\n    }\r\n\r\n\r\n    private Filter csrfHeaderFilter() {\r\n        return new OncePerRequestFilter() {\r\n            @Override\r\n            protected void doFilterInternal(HttpServletRequest request,\r\n                                            HttpServletResponse response, FilterChain filterChain)\r\n                    throws ServletException, IOException {\r\n                CsrfToken csrf = (CsrfToken) request\r\n                        .getAttribute(CsrfToken.class.getName());\r\n                if (csrf != null) {\r\n                    Cookie cookie = new Cookie(\"XSRF-TOKEN\",\r\n                            csrf.getToken());\r\n                    cookie.setPath(\"/\");\r\n                    response.addCookie(cookie);\r\n                }\r\n                filterChain.doFilter(request, response);\r\n            }\r\n        };\r\n    }\r\n\r\n    private CsrfTokenRepository csrfTokenRepository() {\r\n        HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();\r\n        repository.setHeaderName(\"X-XSRF-TOKEN\");\r\n        return repository;\r\n    }\r\n}\r\n```\r\n\r\nHowever, I still get 403 (Forbidden) when I try to access the backend service through the zuul proxy,  after doing a successful login with SSO."},"comment":{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/issues/comments/178029914","html_url":"https://github.com/spring-cloud/spring-cloud-netflix/issues/796#issuecomment-178029914","issue_url":"https://api.github.com/repos/spring-cloud/spring-cloud-netflix/issues/796","id":178029914,"user":{"login":"dsyer","id":124075,"avatar_url":"https://avatars.githubusercontent.com/u/124075?v=3","gravatar_id":"","url":"https://api.github.com/users/dsyer","html_url":"https://github.com/dsyer","followers_url":"https://api.github.com/users/dsyer/followers","following_url":"https://api.github.com/users/dsyer/following{/other_user}","gists_url":"https://api.github.com/users/dsyer/gists{/gist_id}","starred_url":"https://api.github.com/users/dsyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsyer/subscriptions","organizations_url":"https://api.github.com/users/dsyer/orgs","repos_url":"https://api.github.com/users/dsyer/repos","events_url":"https://api.github.com/users/dsyer/events{/privacy}","received_events_url":"https://api.github.com/users/dsyer/received_events","type":"User","site_admin":false},"created_at":"2016-02-01T15:40:09Z","updated_at":"2016-02-01T15:40:09Z","body":"IMO you should map your authorities to scopes and get those added to the tokens. I'm not super clear on where the SSO service stands on that - normally in a UAA all you do is add users to a group. I think that means it depends on where the SSO user details are coming from."}}