Zuul API Gateway using Spring Boot - Part 2 - Implementing Security (OAuth2) in Zuul API Gateway

This video explains about how to implement security in Zuul API Gateway. We are implementing OAuth2 security in Zuul using Spring Boot and all the backend microservices are protected using this OAuth2. Here you can learn about the password grant type and authorization code flow grant type of OAuth2.

[JavaCodingAssist]

Someone had questioned like "classes like UserController, UserService and UserRepository is repeating in both UserService Microservice and Oauth2 Server". UserService is a Microservice which serves you User information. Whereas OAuth2Server uses User information from the database to authenticate and authorize the incoming user. That's the reason some classes are repeating. You don't actually need the UserController and UserService class in OAuth2Server. We need only the UserRepository to get the user information from the database. If it is confusing you, you can remove those 2 classes from OAuth2Server.

[hammadzubair]

very good explanation, help me to do my job you so much.God Bless you

[Know_Youself]

Wow amazing.... Far more better than our organization session.

[suraphelojohannes]

Concise and precise Video Thank You Keep on doing more Videos

[ajaykumarcheekati]

Ma’m your explanation is too good...Kindly make more videos...

[budsyremo]

You are using jwt tokens but are also providing session via cookie, shouldn't they be sessionless ?

[aviator]

Very interesting. i would like to see all playlist for microservice.

[manogariganesan]

Hi mam suppose client application in angular js means is it possible to integrate oauth2 in angular. And client id client secret how can we managing plz update

[khushithakur]

Since Zuul is not part of latest Spring boot version can you suggest alternative?

I must have missed the token generation

[JavaCodingAssist]

By Mistake deleted someone's question. "Who is responsible for authentication here?" Here in this application, authentication too is done by Authorization Server

[sreekanth]

What is Actual Senario meaning of Authorization and Athentication

[moorthymoorthy]

way of teaching very nice. how to jwt configuration will be there instead of OAuth2.

[pavankumar-eyht]

Zool is used in real time projects also?

[alxx]

I dont understand who is in charge of authentication

[MohammadAli-ptjq]

Hi, this is very useful and i was able to to build oauth2 authorization server without eureka server or client since I have only one service to expose to clients. However my only question is why do we need to specify the client-id, client-secret in the service application.properties/yml file? Actual flow is client will use client-id and client-secret, get the access-token/refresh-token and using this access token access the service api. could you please explain how do i achieve this without providing client-id and client-secret in the actual service. Because in this scenario how do we enable this service for multiple clients, since it is bind to client-id and client-secret in the service itself. Once i get the token from authorization server i should be able to access service using this token, provided i do not want to give any client details. Please help me in this scenario, how do we achieve.