title: How use Spring Boot oAuth2 + Azure AD in a stateless micro-service?
body: <p>When I try the sample code from <a href="https://github.com/Microsoft/azure-spring-boot/tree/master/azure-spring-boot-samples/azure-active-directory-spring-boot-backend-sample" rel="noreferrer">Microsoft Azure</a> to use oAuth2 and Spring Boot, it uses a stateful session to check authentication/authorization. You can see this in that:</p>
  
  <ol>
  <li>It never passes any headers/JWT on any calls</li>
  <li>It has a cookie "JSESSIONID" that you can use in new postman session (after obtaining it in a different browser) and it will consider you logged in</li>
  </ol>
  
  <p>This will not work as our micro-services will be multiple instances.</p>
  
  <p>How could I convert this to use a JWT (<code>Authorization: Bearer AQab...</code>) for subsequent calls instead of the cookie?</p>
  
  <p><strong>Dependencies:</strong></p>
  
  <pre><code>//All using Spring Boot 2.0.5.RELEASE
  compile('org.springframework.boot:spring-boot-starter-web')
  compile('org.springframework.boot:spring-boot-starter-webflux')
  compile('org.springframework.boot:spring-boot-starter-security')
  compile('org.springframework.security:spring-security-oauth2-client')
  compile('org.springframework.security:spring-security-oauth2-jose')
  
  //Using 2.0.7
  compile('com.microsoft.azure:azure-active-directory-spring-boot-starter')
  </code></pre>
  
  <p><strong>Config:</strong></p>
  
  <pre><code>import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
  import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
  import org.springframework.security.oauth2.core.oidc.user.OidcUser;
  
  @EnableWebSecurity
  @EnableGlobalMethodSecurity( prePostEnabled = true )
  public class OAuthConfig extends WebSecurityConfigurerAdapter
  {
      @Autowired
      private OAuth2UserService&lt;OidcUserRequest, OidcUser&gt; userService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception
      {
          http
              .authorizeRequests()
              .anyRequest().authenticated()
              .and()
              .oauth2Login()
              .userInfoEndpoint()
              .oidcUserService( userService );
      }
  }
  </code></pre>
  
  <p><strong>Controller:</strong></p>
  
  <pre><code>import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.security.access.prepost.PreAuthorize;
  import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
  import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
  import org.springframework.stereotype.Controller;
  import org.springframework.web.bind.annotation.GetMapping;
  import org.springframework.web.bind.annotation.ResponseBody;
  
  @Controller
  public class MainController
  {
      private OAuth2AuthorizedClientService clientService;
  
      @Autowired
      public MainController(OAuth2AuthorizedClientService clientService)
      {
          this.clientService = clientService;
      }
  
      @GetMapping( "checkrole" )
      @ResponseBody
      @PreAuthorize( "hasRole('ROLE__Test')" )
      public String group1()
      {
          return "ok";
      }
  
      @GetMapping( "/" )
      @ResponseBody
      public String getUser(OAuth2AuthenticationToken userToken)
      {
          //Printing out the oAuth token just for testing
          return clientService.loadAuthorizedClient(
              userToken.getAuthorizedClientRegistrationId(),
              userToken.getName()
          ).getAccessToken().getTokenValue();
      }
  }
  </code></pre>
  
  <p><strong>application.yml:</strong></p>
  
  <pre><code>spring:
    security:
      oauth2:
        client:
          registration:
            azure:
              client-id: ${YOUR_CLIENT_ID:}
              client-secret: ${YOUR_CLIENT_SECRET:}
  
  azure:
    activedirectory:
      tenant-id: ${YOUR_TENANT_OR_DIRECTORY_ID:}
      active-directory-groups: Test
  </code></pre>
  
  <h2>Complete Sample Code</h2>
  
  <p><a href="https://github.com/Microsoft/azure-spring-boot/tree/master/azure-spring-boot-samples/azure-active-directory-spring-boot-backend-sample" rel="noreferrer">https://github.com/Microsoft/azure-spring-boot/tree/master/azure-spring-boot-samples/azure-active-directory-spring-boot-backend-sample</a></p>