Authentication in spring cloud gateway

Question

I am newbie to spring cloud. I am trying to integrate spring cloud gateway(spring cloud Finchley.SR1) just to authenticate and route my requests.

My Application stack is as follows

• Main Dashboard Application built using spring mvc and angular. It has login page and a dashboard. Authentication is integrated in it which authenticates user credentials against database. I also use hazelcast for session replication in this app.
• Set of Downstream services which will be invoked once user logs into above dashboard and navigates inside it.
• An API Gateway built using spring cloud gateway: For now it does only routing.

  cloud:
    gateway:
      routes:
        - id: customers
          uri: http://localhost:8282/customers
          predicates:
          - Path=/customers/**
          - Header=employeeId, \d+
          filters:
          - RewritePath=/customers/(?<segment>.*), /$\{segment}
        - id: rates
          uri: http://localhost:8383/rates
          predicates:
          - Path=/rates/**
          filters:
          - RewritePath=/rates/(?<segment>.*), /$\{segment}

Need to implement following

• First request will come to gateway I need to check if user is authenticated or not, if not authenticated then I need to show login page of Dashboard Application(i.e first app) or else allow user to proceed.
• Once user logged in and navigating inside dashboard then api requests to downstream services will also go through api gateway I need authenticate these requests as well and send 403 status if user is not authenticated.

I am not able to figure out how to handle these authentications in spring cloud gateway app. Is it possible to leverage hazelcast session replication that I added in Main Dashboard App, use it validate the user in gateway?

Or is there any better approach using spring cloud suite tools that I can use it here. A sample app will be useful

Answer 1

In my case, I customized AuthenticationWebFilter class in Spring Security 2.0.5. And I customized ServerAuthenticationConverter class and SuccessHandler, FailureHandler and ReactiveAuthenticationManager class in AuthenticationWebFilter. If you use Spring security, I recommend searching the WebFilter. I hope it helps.