<p>I'm struggling with authorization problem within my local kubernetes cluster when my application are replicated and listen behind load balancer.  </p>

<p><a href="https://i.stack.imgur.com/Pk5vq.jpg" rel="nofollow noreferrer">architecture-image</a></p>

<p>I've created some basic application using spring boot and security oauth2 library. I've also launch keycloak (sso) application. They are listening under domains: hello.org (app) and sso.org (keycloak). I thought to add some load balancing before application, but there is the main problem. How to properly complete the login process if the requests are spread evenly over e.g two pods? The authorization process required few redirects, so first request will go to first one, second to another and process will fail cause they don't have shared information about state. </p>

<p>I'm using authorization code flow.</p>

<p>Here is my libraries responsible for security implementation and basic config.</p>

<pre class="lang-xml prettyprint-override"><code>&lt;dependency&gt;
    &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
    &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
&lt;/dependency&gt;
&lt;dependency&gt;
    &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
    &lt;artifactId&gt;spring-security-oauth2-client&lt;/artifactId&gt;
&lt;/dependency&gt;
&lt;dependency&gt;
    &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
    &lt;artifactId&gt;spring-security-oauth2-jose&lt;/artifactId&gt;
&lt;/dependency&gt;
</code></pre>

<pre><code>server:
  port: 8080

logging:
  level:
    org.springframework.security: DEBUG
    org.springframework.security.oauth2: DEBUG
    org.springframework.security.jwt: DEBUG

keycloak-client:
  server-url: http://sso.org/auth
  realm: demo

spring:
  security:
    oauth2:
      client:
        registration:
          keycloak:
            client-id: hello-app
            client-secret: b3ed7f13-88cc-4de1-9dc0-59c80b310dfb
            client-name: Hello Application
            authorization-grant-type: authorization_code
            redirect-uri: '{baseUrl}/login/oauth2/code/{registrationId}'
            scope:
              - hello
              - openid
              - profile
              - email
        provider:
          keycloak:
            token-uri: ${keycloak-client.server-url}/realms/${keycloak-client.realm}/protocol/openid-connect/token
            authorization-uri: ${keycloak-client.server-url}/realms/${keycloak-client.realm}/protocol/openid-connect/auth
            user-info-uri: ${keycloak-client.server-url}/realms/${keycloak-client.realm}/protocol/openid-connect/userinfo
            jwk-set-uri: ${keycloak-client.server-url}/realms/${keycloak-client.realm}/protocol/openid-connect/certs
            user-name-attribute: preferred_username
    filter:
      order: 100
</code></pre>

Faelivrinx
<p>I found a way to resolve my problem with <strong>sticky session</strong> implementation on Load Balancer. It's not the best solution, but for my case is just fine. 
Here is my Ingress configuration to enable sticky session.</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: hello-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-name: "INGRESS"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
    nginx.ingress.kubernetes.io/session-cookie-path: /
spec:
  rules:
    - host: hello.org
      http:
        paths:
          - path: /
            backend:
              serviceName: hello-app
              servicePort: 8080

</code></pre>

<p>For more information visit:  <a href="https://kubernetes.github.io/ingress-nginx/examples/affinity/cookie/" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/examples/affinity/cookie/</a></p>
