vaadin / vaadin/flow-crm-tutorial

Tutorial with no Login View and spring ressource-server

Open
#129 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
204
Forks
194
Avg merge
55m
Merged PRs (30d)
2

Description

Hi, I'm not sure where to put this, so here I am.

I'm developing a rather big micro service cloud application with dozen of services, two of whom have a vaadin frontend.
They are obviously behind a reverse proxy (nginx) which handles the authentication (forwards to an IDP).

In the documentation (https://vaadin.com/docs/latest/security/enabling-security) it states the requirement for a login view and a log out capability. I have the latter, but no vaadin log in view.

On the other hand I just wan't to configure the jwt security with spring using a ressource-server to check the provided bearer token.

Could you please provide a tutorial, how this is supposed to be configured?

I currently have this configuration, but am not sure, if this is correct.

@Override
    protected void configure(final HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers(ACTUATOR_HEALTH_ENDPOINT).permitAll();
        http.authorizeRequests().antMatchers(ACTUATOR_PROMETHEUS_ENDPOINT).permitAll();

        super.configure(http);

        http.cors()
                .and()
                .oauth2ResourceServer()
                .jwt();
    }

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Vaadin security documentation and the HttpSecurity configuration shown in the issue. Determine how a Vaadin frontend behind an nginx-authenticated reverse proxy should use Spring's OAuth2 resource server and JWT support without a Vaadin login view, then document the required configuration and logout behavior as a tutorial.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
authentication, documentation
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.