Guide to using the ForgeRock® Microgateway for new users and readers evaluating the product.

Before you start, download and run the sample application as described in Installing the Sample Application, in the IG Getting Started. The sample application acts as Microservice A.

1. Set up the example in Introspecting Stateful Access_Tokens With the Token Validation Microservice, in the Token Validation Microservice User Guide.

2. In AM, edit the microservice client to add a scope to access the protected microservice:

   1. Select Applications > OAuth 2.0 > Clients.

   2. Select microservice-client, and add the following scope: microservice-A

3. Add the following route to the Microgateway configuration as /path/to/microservices/identity-gateway/config/routes/mgw.json:

   {
     "properties": {
       "introspectOAuth2Endpoint": "http://mstokval.example.com:9090"
     },
     "capture": "all",
     "name": "mgw",
     "baseURI": "http://app.example.com:8081",
     "condition": "${matches(request.uri.path, '^/home/mgw')}",
     "handler": {
       "type": "Chain",
       "config": {
         "filters": [
           {
             "name": "OAuth2ResourceServerFilter-1",
             "type": "OAuth2ResourceServerFilter",
             "config": {
               "requireHttps": false,
               "accessTokenResolver": {
                 "name": "TokenIntrospectionAccessTokenResolver-1",
                 "type": "TokenIntrospectionAccessTokenResolver",
                 "config": {
                   "endpoint": "&{introspectOAuth2Endpoint}/introspect",
                   "providerHandler": "ForgeRockClientHandler"
                 }
               },
               "scopes": ["microservice-A"]
             }
           }
         ],
         "handler": "ReverseProxyHandler"
       }
     }
   }
   

   Notice the following features of the route:

   • The route matches requests to the Microgateway on http://microgateway.example.com:8080/home/mgw, and rebases them to the sample application, on http://app.example.com:8081.

   • The OAuth2ResourceServerFilter expects an OAuth 2.0 access_token in the header of the incoming authorization request, with the scope microservice-A.

   • If the filter successfully validates the access_token, the ReverseProxyHandler passes the request to the sample application.

1. With the Microgateway, Token Validation Microservice, and sample application running, get an access_token from AM, using the scope microservice-A:

   $ mytoken=$(curl \
     --request POST \
     --url http://openam.example.com:8088/openam/oauth2/access_token \
     --user microservice-client:password \
     --data grant_type=client_credentials \
     --data scope=microservice-A --silent | jq -r .access_token)

2. View the access_token:

   $ echo $mytoken
   eyJ...FPg

3. Call the Microgateway to access microservice A:

   $ curl -v --header "Authorization: Bearer ${mytoken}" http://microgateway.example.com:8080/home/mgw

   The home page of the sample application is displayed.