<p>So, currently i have a front-end server, a bff( back end for front end server also named gateway ) , a resource server and the auth server.</p>
<p>The BFF is configured as java spring boot with spring oauth 2 client dependency.</p>
<p>Every oauth flow is done trought the BFF server. This BFF redirects to the front end user ( browser ) auth-server uris and endpoints . And after auth is successful then it stores the access and refresh token and then it fetches resources from the resource server.</p>
<p>On local everything is working, i have set up a custom domain &quot;custom-domain&quot; linked up to 127.0.0.1 in order to avoid localhost because of that redirect uri issue that doesn't allow you to specify &quot;localhost&quot; as a redirect uri.</p>
<p>Also, the BFF service has a context-path of /client in order to be different than the auth server and not have a clash on the cookies ( this is at least what i read idk if it is necesarily corect )</p>
<p>Now, i'm trying to deploy them in a kubernetes cluster on my local docker. All 4 services would be in the same cluster, and every one of them would be ClusterIp. Also a Ingress would be availbale to route traffic in the cluster.</p>
<p>I also have two custom domains:</p>
<ol>
<li>api.custom.com that links to the gateway</li>
<li>auth.custom.com that links to the auth server</li>
</ol>
<p>However, the issuer-uri from the gateway ( the address to comunicate with the auth server inside the cluster) is set to auth-server ( kubernetes label) . So there are two communications:</p>
<ol>
<li>FE - Auth server when bff sends the redirect uris ( auth.custom.com )</li>
<li>BFF - AUTH server for direct communcation ( auth-server)</li>
</ol>
<p>And unfortunately, there is a issue, first of all when the auth.custom.com/oauth2/authorize?response_type/* will reach the auth server, an Invoking ExceptionTranslationFilter will apper in the logs , unlike on the local logs where Invoking OAuth2AuthorizationEndpointFilter (8/20) is taking place.</p>
<p>Can session/domain issues/topics be explained somewhow regarding the authorization server as well as kubernetes related stuff?</p>
<p>For example, can an auth server be inside the same cluster? should it be cluster, node port , load balancer? What session/domain issues can prevent auth workflow from working properly?</p>

loredon
<p>My <a href="https://github.com/ch4mpy/spring-addons/tree/master/samples%2Ftutorials" rel="nofollow noreferrer">BFF tutorial</a> is <a href="https://bff.demo.c4-soft.com/ui/" rel="nofollow noreferrer">deployed</a> to a K8s cluster and one of the 3 authorization servers (a Keycloak instance) is hosted by the same cluster.</p>
<p>Authorisation server and BFF are configured completely separately: different namespaces, different ingresses and even different sub-domains (respectively <code>oidc.c4-soft.com</code> and <code>bff.demo.c4-soft.com</code>).</p>
<p>Also, most of the routing is handled by the BFF itself (not the ingress) which is implemented with <code>spring-cloud-gateway</code> configured as OAuth2 client and with <code>TokenRelay</code> filter (like you are doing, apparently).</p>
<p>The ingresses are used only to route <code>oidc.c4-soft.com</code> to the Keycloak service and <code>bff.demo.c4-soft.com</code> to the BFF one. What to do with a request based on its path is determined with <code>spring-cloud-gateway</code> <a href="https://github.com/ch4mpy/spring-addons/blob/ed1e8da796dafd667ae5f308d05d62726066449c/samples/tutorials/bff/gateway/src/main/resources/application.yml#L64" rel="nofollow noreferrer">configuration</a>, just as when running outside of K8s.</p>
<p>Both resource servers (REST APIs) and front-end (Angular app) are served (and routed) by BFF, which greatly simplifies CORS configuration: requests have the same origin.</p>
