title: Spring Boot 2.0 / OAuth2 / JWT / Zuul / Microservices
body: <p>I'm trying to build a <strong>microservice architecture</strong>. But i'm <strong>struggling</strong> since two days <strong>with OAuth2 and Zuul</strong>. I managed to run a Auth/Resource-Server on the same service, but not with Zuul. At the moment i'm swichting to another service, the authorization doesn't work anymore. I t<strong>ried many guides</strong> (as an example Baeldung) but <strong>no one works for me</strong>. Probably because i'm using <strong>Spring Boot 2.0.3</strong>? <strong>Most guides using Spring Boot 1.5.x</strong>. </p>
  
  <p>I think it's a <strong>problem of configuration</strong>. I'm using Eureka for service discovering, Zuul as Gateway and entry point. When the user request a protected service, he should be redirectet to my auth-service (OAuth2/JWT). <strong>The token he gets after login should be stored by Zuul (right ?)</strong>. Actually <strong>Zuul doesn't get the token or doesn't store it</strong>. Do I have to do this by my own or should Zuul and OAuth manage this and I just have bad configurations? Could someone show me, how you configure this architecture or a <strong>new/working guide for Spring Boot 2.0.3?</strong> I'm actually really frustrated, <strong>need help</strong>. I'm new to Spring, but have to learn it for work. But at the moment i'm just overstrained.</p>
  
  <p>Additional infos:</p>
  
  <p>I didnt create any views now. I just defined some default controller which return <code>String</code>s and are secured by <code>@PreAuthorize</code>.</p>
  
  <p><strong>Gateway-Service:</strong></p>
  
  <blockquote>
    <p>GatewayServiceApplication.java</p>
  </blockquote>
  
  <pre><code>@SpringBootApplication
  @EnableZuulProxy
  @EnableDiscoveryClient
  @Configuration
  public class GatewayServiceApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(GatewayServiceApplication.class, args);
      }
  }
  </code></pre>
  
  <blockquote>
    <p>SecurityConfig.java</p>
  </blockquote>
  
  <pre><code>@Configuration
  @EnableOAuth2Sso
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception {
          http.antMatcher("/**")
                  .httpBasic().disable()
                  .authorizeRequests()
                  .antMatchers("/", "/core/", "/core/login**", "/oauth/authorize", 
                   "/core/oauth/authorize", "/login")
                  .permitAll()
                  .anyRequest()
                  .authenticated()
                  .and()
                  .formLogin().permitAll();
      }
  }
  </code></pre>
  
  <p>Here I had a lot of different <code>antMatchers</code>.</p>
  
  <blockquote>
    <p>application.properties</p>
  </blockquote>
  
  <pre><code>server.port=8000
  spring.application.name=gateway-service
  eureka.client.service-url.defaultZone=http://localhost:8001/eureka/
  security.oauth2.sso.login-path=http://localhost:8000/core/login
  security.oauth2.client.client-id=zuul
  security.oauth2.client.client-secret=zuul
  security.oauth2.client.access-token-uri=http://localhost:8000/core/oauth/token
  security.oauth2.client.user-authorization-uri=http://localhost:8000/core/oauth/authorize
  #security.oauth2.resource.user-info-uri=http://localhost:8000/core/user/me
  security.oauth2.resource.user-info-uri=http://localhost:8000/core/secured
  spring.thymeleaf.cache=false
  </code></pre>
  
  <p>I think here's a failure.</p>
  
  <p><strong>Core-Service</strong></p>
  
  <blockquote>
    <p>CoreApplication.java</p>
  </blockquote>
  
  <pre><code>@SpringBootApplication
  @EnableDiscoveryClient
  @EnableResourceServer
  public class CoreApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(CoreApplication.class, args);
      }
  }
  </code></pre>
  
  <blockquote>
    <p>AuthServerConfig</p>
  </blockquote>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
  
      @Autowired
      private BCryptPasswordEncoder passwordEncoder;
  
      @Override
      public void configure(
              AuthorizationServerSecurityConfigurer oauthServer) throws Exception {
          oauthServer.tokenKeyAccess("permitAll()")
                  .checkTokenAccess("isAuthenticated()");
      }
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
                  .withClient("zuul")
                  .secret(passwordEncoder.encode("zuul"))
                  .authorizedGrantTypes("authorization_code")
                  .scopes("user_info")
                  .autoApprove(true)
                  .redirectUris("http://localhost:8000/core/secured");
      }
  }
  </code></pre>
  
  <blockquote>
    <p>SecurityConfig</p>
  </blockquote>
  
  <pre><code>@Configuration
  @Order(1)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
                  .withUser("john")
                  .password(passwordEncoder().encode("123"))
                  .roles("USER");
      }
  
      @Bean
      public BCryptPasswordEncoder passwordEncoder(){
          return new BCryptPasswordEncoder();
      }
  }
  </code></pre>
  
  <blockquote>
    <p>application.properties</p>
  </blockquote>
  
  <pre><code>server.port=8003
  spring.application.name=core
  eureka.client.service-url.defaultZone=http://localhost:8001/eureka
  </code></pre>
  
  <p>Ok, especially here I changed many things. So probably I destroyed much from older guides. (Sorry my english is bad!)</p>