title: Spring - Remote Basic Authentication
body: <p>I'm rewriting a Monolith Java/Spring server to Microservices while exposing the same API interface to the clients so they won't notice any change was made.</p>
  
  <p>In the Monolith server we use <code>Spring-Security</code> and <code>Spring-Security-OAuth2</code>.</p>
  
  <p>The first part is creating a Java based API-Gateway which will handle all authentication/authorization as a tunnel to the Monolith server.</p>
  
  <p>After creating a new microservice (using spring initializr) I have tried to configure spring security to tunnel all Authentication to the Monolith Server using:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      private final AuthenticationProvider authenticationProvider;
  
      public WebSecurityConfig(AuthenticationProvider authenticationProvider) {
          this.authenticationProvider = authenticationProvider;
      }
  }
  </code></pre>
  
  <pre><code>@Component("authenticationProvider")
  public class CustomRemoteAuthenticationProvider extends RemoteAuthenticationProvider {
  
      @Override
      @Autowired
      @Qualifier("remoteAuthenticationManager")
      public void setRemoteAuthenticationManager(RemoteAuthenticationManager remoteAuthenticationManager) {
          super.setRemoteAuthenticationManager(remoteAuthenticationManager);
      }
  
  }
  </code></pre>
  
  <pre><code>@Service("remoteAuthenticationManager")
  public class CustomRemoteAuthenticationManager implements RemoteAuthenticationManager {
  
      @Override
      public Collection&lt;? extends GrantedAuthority&gt; attemptAuthentication(String username, String password) throws RemoteAuthenticationException {
          ... here I do an HTTP call to the Monolith `/oauth/login`
      }
  }
  </code></pre>
  
  <p>This seems to be working as I visit the <code>http://localhost:8080/login</code> page of the spring-security, I can successfully login and the request is tunneled into our Monolith server.</p>
  
  <p>The problem starts when I try to configure the <code>OAuth2</code> resource server, as our clients currently authenticating using a POST to <code>oauth/token</code> with some Basic Authentication in the Header:</p>
  
  <pre><code>Basic xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  </code></pre>
  
  <p>Note: The token for the basic is a static token for all clients (I know it's not worth anything but this is the way it's currently implementated and I try to implement a fully compatible API-Gateway)</p>
  
  <p>Which allows them to communicate with that end-point and get a valid token for the user/password in the body (Which is application/x-www-form-urlencoded):</p>
  
  <pre><code>password=somepassword&amp;username=user@example.com&amp;grant_type=password&amp;scope=read%20write
  </code></pre>
  
  <p>The problem is that spring-security returning a <code>401 Unauthorized</code> for that call without even letting the request enter the <code>/oauth/login</code> route and do a remote authentication.</p>
  
  <p>I can't find a way to tunnel the Basic Authentication into the monolith server so the <code>/oauth/login</code> will actually authenticate against the Monolith with Remote Basic Authentication and after success it will act as a tunnel and will pass the body itself into the Monolith <code>/oauth/login</code> end point (as I succesfully did in the <code>WebSecurityConfig</code> above)</p>
  
  <p>Any direction will be appreciated.
  Thanks in advance!</p>