Join our book community on Discord

https://packt.link/EarlyAccess

In this chapter, we will see how we can secure access to the APIs and web pages exposed by the edge server introduced in the previous chapter. We will learn how to use HTTPS to protect against eavesdropping on external access to our APIs, and how to use OAuth 2.0 and OpenID Connect to authenticate and authorize users and client applications to access our APIs. Finally, we will use HTTP Basic authentication to secure access to the discovery server, Netflix Eureka.The following topics will be covered in this chapter:

• An introduction to the OAuth 2.0 and OpenID Connect standards
• A general discussion on how to secure the system landscape
• Protecting external communication with HTTPS
• Securing access to the discovery server, Netflix Eureka
• Adding a local authorization server to our system landscape
• Authenticating and authorizing API access using OAuth 2.0 and OpenID Connect
• Testing with the local authorization server
• Testing...

Technical requirements

For instructions on how to install the tools used in this book and how to access the source code for this book, see:

• Chapter 21 for macOS
• Chapter 22 for Windows

The code examples in this chapter all come from the source code in $BOOK_HOME/Chapter11.If you want to view the changes applied to the source code in this chapter, that is, see what it took to secure access to the APIs in the microservice landscape, you can compare it with the source code for Chapter 10, Using Spring Cloud Gateway to Hide Microservices behind an Edge Server. You can use your favorite diff tool and compare the two folders, $BOOK_HOME/Chapter10 and $BOOK_HOME/Chapter11.

Introduction to OAuth 2.0 and OpenID Connect

Before introducing OAuth 2.0 and OpenID Connect, let's clarify what we mean by authentication and authorization. Authentication means identifying a user by validating credentials supplied by the user, such as a username and password. Authorization is about giving access...

11 Securing Access to APIs

Join our book community on Discord

https://packt.link/EarlyAccess

In this chapter, we will see how we can secure access to the APIs and web pages exposed by the edge server introduced in the previous chapter. We will learn how to use HTTPS to protect against eavesdropping on external access to our APIs, and how to use OAuth 2.0 and OpenID Connect to authenticate and authorize users and client applications to access our APIs. Finally, we will use HTTP Basic authentication to secure access to the discovery server, Netflix Eureka.The following topics will be covered in this chapter:

• An introduction to the OAuth 2.0 and OpenID Connect standards
• A general discussion on how to secure the system landscape
• Protecting external communication with HTTPS
• Securing access to the discovery server, Netflix Eureka
• Adding a local authorization server to our system landscape
• Authenticating and authorizing API access using OAuth 2.0 and OpenID Connect
• Testing with the local...

Securing the system landscape

To secure the system landscape as described in the introduction to this chapter, we will perform the following steps:

• Encrypt external requests and responses to and from our external API using HTTPS to protect against eavesdropping
• Authenticate and authorize users and client applications that access our APIs using OAuth 2.0 and OpenID Connect
• Secure access to the discovery server, Netflix Eureka, using HTTP basic authentication

We will only apply HTTPS for external communication to our edge server, using plain HTTP for communication inside our system landscape.

In the chapter on service meshes (Chapter 18, Using a Service Mesh to Improve Observability and Management) that will appear later in this book, we will see how we can get help from a service mesh product to automatically provision HTTPS to secure communication inside a system landscape.

For test purposes, we will add a local OAuth 2.0 authorization server to our system landscape. All external...

Protecting external communication with HTTPS

In this section, we will learn how to prevent eavesdropping on external communication, for example, from the internet, via the public APIs exposed by the edge server. We will use HTTPS to encrypt communication. To use HTTPS, we need to do the following:

• Create a certificate: We will create our own self-signed certificate, sufficient for development purposes
• Configure the edge server: It has to be configured to accept only HTTPS-based external traffic using the certificate

The self-signed certificate is created with the following command:

keytool -genkeypair -alias localhost -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore edge.p12 -validity 3650

The source code comes with a sample certificate file, so you don't need to run this command to run the following examples.

The command will ask for a number of parameters. When asked for a password, I entered password. For the rest of the parameters, I simply entered an empty value to...

Securing access to the discovery server

Previously, we learned how to protect external communication with HTTPS. Now we will use HTTP Basic authentication to restrict access to the APIs and web pages on the discovery server, Netflix Eureka. This means that we will require a user to supply a username and password to get access. Changes are required both on the Eureka server and in the Eureka clients, described as follows.

Changes in the Eureka server

To protect the Eureka server, the following changes have been applied in the source code:

1. In build.gradle, a dependency has been added for Spring Security:

implementation 'org.springframework.boot:spring-boot-starter-security'

1. Security configuration has been added to the SecurityConfig class:
   1. The user is defined as follows:

@Bean
public InMemoryUserDetailsManager userDetailsService() {
  UserDetails user = User.withDefaultPasswordEncoder()
      .username(username)
      .password(password)
      .roles("USER"...

Adding a local authorization server

To be able to run tests locally and fully automated with APIs that are secured using OAuth 2.0 and OpenID Connect, we will add an authorization server that is compliant with these specifications to our system landscape. Spring Security, unfortunately, does not provide an authorization server out of the box. But in April 2020, a community-driven project, Spring Authorization Server, led by the Spring Security team, was announced with the goal of delivering an authorization server. In August 2021, the Spring Authorization Server project was moved out of experimental status and became a member of the Spring project's portfolio. For more information, see https://spring.io/blog/2020/04/15/announcing-the-spring-authorization-server and https://spring.io/blog/2021/08/17/spring-authorization-server-officially-moves-to-spring-projects.The Spring Authorization Server supports both the use of the OpenID Connect discovery endpoint and digital signing of access...

11 Securing Access to APIs

Join our book community on Discord

https://packt.link/EarlyAccess

In this chapter, we will see how we can secure access to the APIs and web pages exposed by the edge server introduced in the previous chapter. We will learn how to use HTTPS to protect against eavesdropping on external access to our APIs, and how to use OAuth 2.0 and OpenID Connect to authenticate and authorize users and client applications to access our APIs. Finally, we will use HTTP Basic authentication to secure access to the discovery server, Netflix Eureka.The following topics will be covered in this chapter:

• An introduction to the OAuth 2.0 and OpenID Connect standards
• A general discussion on how to secure the system landscape
• Protecting external communication with HTTPS
• Securing access to the discovery server, Netflix Eureka
• Adding a local authorization server to our system landscape
• Authenticating and authorizing API access using OAuth 2.0 and OpenID Connect
• Testing with the local...

Testing with the local authorization server

In this section we will try out the secured system landscape; that is, we will test all the security components together. We will use the local authorization server to issue access tokens. The following tests will be performed:

1. First, we build from source and run the test script to ensure that everything fits together.
2. Next, we will test the protected discovery server's API and web page.
3. After that, we will learn how to acquire access tokens using OAuth 2.0 client credentials and authorization code grant flows.
4. With the issued access tokens, we will test the protected APIs. We will also verify that an access token issued for a reader client can't be used to call an updating API.
5. Finally, we will also verify that Swagger UI can issue access tokens and call the APIs.

Building and running the automated tests

To build and run automated tests, we perform the following steps:

1. First, build the Docker images from source with the following...