<p>We have 8 java microservices talking to each other in kubeneters cluster. Each microservice is bundled with auth library which intercepts and validates/renews JWT token for each REST request to controllers. </p>

<p>Scenario:
From Frontend, we get access token for the first time, Authentication gets successful. Lets say</p>

<ol>
<li>Frontend hit 'Microservice A' with access token - Successful</li>
<li>'Microservice A' internally hits 'Microservice B' via restTemplate.
My 'Microservice B' also needs logged in user details.</li>
</ol>

<p>Issue: I have to pass same access token from 'A' to 'B' but I am not able to get access token in Controller/Service logic but can get only in filters where token is being validated. I can get token in Rest Controllers by adding following argument in all rest methods in controller:</p>

<pre><code>@RequestHeader (name="Authorization") String token
</code></pre>

<p>But I dont want to go with this approach as I have to pass this token to everywhere till end and have to declare this argument in all APIS.</p>

<p>I want to get token from TokenStore by passing authentication object. We are using Oauth2 and I checked the code in library, There are many tokenStore providers.</p>

<p>In DefaultTokenServices.java class, I am calling </p>

<pre><code>Authentication auth = SecurityContextHolder.getContext().getAuthentication() // Passed this auth to tokenStore
String token = tokenStore.getAccessToken(auth).getValue(); // NullPointerException
</code></pre>

<p>My code is going through JWTTokenStore provider which is returning null. I checked, there is a provider called InMemoryTokenStore.class which actually extrActs token from store. But my flow is not going into in memory implementation. </p>

<p>Is there any way I can get token afterwards without grabbing it in controller via arguments? or how can I enable/use inMemoryTokenStore?</p>

<p>Also recommend something better for kubernetes intercommunication authentication?</p>

<p>TIA</p>

Roobal Jindal
<p>It looks like you're using Spring (and Spring Security), so I believe the relevant part of the docs is the part on <a href="https://docs.spring.io/spring-security/site/docs/current/reference/html5/#bearer-token-propagation" rel="nofollow noreferrer">Bearer Token Propagation</a>.</p>

<p>Its recommendation is to use a <code>WebClient</code> (the recommended replacement for <code>RestTemplate</code> as of Spring 5) that uses the provided <code>ServletBearerExchangeFilterFunction</code> to automagically propagate the JWT token from the incoming request into the outgoing request:</p>

<pre><code>@Bean
public WebClient rest() {
    return WebClient.builder()
            .filter(new ServletBearerExchangeFilterFunction())
            .build();
}
</code></pre>

<p>On <code>RestTemplate</code>, the docs say:</p>

<blockquote>
  <p>"There is no dedicated support for RestTemplate at the moment, but you can achieve propagation quite simply with your own interceptor"</p>
</blockquote>

<p>and the following example is provided:</p>

<pre><code>@Bean
RestTemplate rest() {
    RestTemplate rest = new RestTemplate();
    rest.getInterceptors().add((request, body, execution) -&gt; {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        if (authentication == null) {
            return execution.execute(request, body);
        }

        if (!(authentication.getCredentials() instanceof AbstractOAuth2Token)) {
            return execution.execute(request, body);
        }

        AbstractOAuth2Token token = (AbstractOAuth2Token) authentication.getCredentials();
        request.getHeaders().setBearerAuth(token.getTokenValue());
        return execution.execute(request, body);
    });
    return rest;
}
</code></pre>

<p>I don't believe you need to be looking at <code>TokenStore</code>s if all you're trying to do is propagate the token. Remember everything relevant about a JWT should be inside the token itself. (Which is why <a href="https://docs.spring.io/spring-security/oauth/apidocs/org/springframework/security/oauth2/provider/token/store/JwtTokenStore.html" rel="nofollow noreferrer">the doc for the JwtTokenStore</a> explains that it doesn't actually store anything, but just pulls info out of the token, and will return null for some methods, including the <code>getAccessToken()</code> method you're calling.)</p>
