# Java Microservices with Spring Cloud Config and JHipster **URL:** \ **Category:** Developer Blog Comments\ **Created:** [May 21, 2019, 9:29pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058 "2019-05-21T21:29:56Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 21, 2019, 9:29pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/1 "2019-05-21T21:29:56Z")
[Java Microservices with Spring Cloud Config and JHipster](https://developer.okta.com/blog/2019/05/23/java-microservices-spring-cloud-config) This tutorial shows you how to build a microservices architecture with Spring Boot and Spring Cloud Config using JHipster. ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 24, 2019, 4:11pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/2 "2019-05-24T16:11:04Z")
**Raul Rotundo** Hi Matt, I have some problems with @PreAuthorize annotation using keycloak. I cloned your [repo](https://github.com/oktadeveloper/java-microservices-examples "https://github.com/oktadeveloper/java-microservices-examples") and after you added to any controller resource the annotation, for example: ` @PreAuthorize(“hasRole(”" + AuthoritiesConstants.ADMIN + “”)")` I receive an 403 forbidden error. Here some logs: `com.okta.developer.store.repository.CustomAuditEventRepository.add() with argument[s] = [AuditEvent [timestamp=2019-05-24T16:01:34.758324Z, principal=4c973896-5761-41fc-8217-07c5d13a004b, type=AUTHENTICATION_SUCCESS, data={details=org.springframework.security.web.authentication.WebAuthenticationDetails@ffffa64e: RemoteIpAddress: 172.18.0.5; SessionId: null}]]` `com.okta.developer.store.repository.CustomAuditEventRepository.add() with argument[s] = [AuditEvent [timestamp=2019-05-24T16:01:34.889309Z, principal=4c973896-5761-41fc-8217-07c5d13a004b, type=AUTHORIZATION_FAILURE, data={details=org.springframework.security.web.authentication.WebAuthenticationDetails@ffffa64e: RemoteIpAddress: 172.18.0.5; SessionId: null, type=org.springframework.security.access.AccessDeniedException, message=Access is denied}]]` This means the user authentication was successfully but after that, I get the authorization failure. This could be for a misconfiguration of the “internal” client (jhipster-realm.json)? I don’t know. I appreciate your help. Thanks ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 24, 2019, 6:45pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/3 "2019-05-24T18:45:51Z")
**Brian Demers** Hey Raul! One of the things I do to help troubleshoot this type of issue is I comment out the `@PreAuthorize` annotation, and inject the `JwtAuthenticationToken` (or similar Authentication). From there you can set a breakpoint or log the results of `JwtAuthenticationToken.getAuthorities()` You can also check the `getTokenAttributes()` to make sure your `groups` claim is set. Let us know what you find! ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 25, 2019, 11:27am UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/4 "2019-05-25T11:27:06Z")
**Raul Rotundo** Hi Brian! Thanks for your response, this is what I got: jwtAuthenticationToken: `jwtAuthenticationToken: org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken@3d4af8fe: Principal: org.springframework.security.oauth2.jwt.Jwt@f47b3487; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@ffffe21a: RemoteIpAddress: 172.18.0.7; SessionId: null; Granted Authorities: SCOPE_openid, SCOPE_jhipster, SCOPE_email, SCOPE_offline_access, SCOPE_profile, SCOPE_address, SCOPE_phone` jwtAuthenticationToken.getTokenAttributes(): `{sub=4c973896-5761-41fc-8217-07c5d13a004b, resource_access={“account”:{“roles”:[“manage-account”,“manage-account-links”,“view-profile”]}}, email_verified=true, address={}, allowed-origins=[“http://localhost:8080/","http://localhost:8100/”,“http://127.0.0.1:8761/","http://localhost:9000/”], iss=http://keycloak:9080/auth/realms/jhipster, typ=Bearer, preferred_username=admin, given_name=Admin, aud=[account], acr=0, nbf=1970-01-01T00:00:00Z, realm_access={“roles”:[“ROLE_USER”,“offline_access”,“ROLE_ADMIN”,“uma_authorization”]}, azp=web_app, auth_time=1558781630, scope=openid jhipster email offline_access profile address phone, name=Admin Administrator, exp=2019-05-25T11:06:17Z, session_state=160e0882-155f-40dc-bdf8-46d0f846738c, iat=2019-05-25T11:01:17Z, family_name=Administrator, jti=5d413238-1859-4d3b-89fc-62581205dd33, email=admin@localhost}` jwtAuthenticationToken.getName() (User ID): `4c973896-5761-41fc-8217-07c5d13a004b` As you can see on jwtAuthenticationToken.getTokenAttributes() logs, there is no “groups” claim set, how can I do this on keycloak and okta? Another question is why this is not working if I can see “Roles” claims and it’s also present ROLE\_ADMIN on that? By the way, this is what I got when I generated a jhipster microservices application (Registry, Gateway, a Microservice, Keycloak, etc…) using Jhipster version 6.0.1 without any modification, same way Matt did in order to create this post. Regards, Raul ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 27, 2019, 9:45pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/5 "2019-05-27T21:45:23Z")
**Jose Diaz diaz** I am stopped in this part Create Groups and Add Them as Claims to the ID Token . Maybe some video is better, because I am not familiar with okta. ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 28, 2019, 6:10am UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/6 "2019-05-28T06:10:02Z")
**Matt Raible** Here’s a screencast I did last month that shows how to setup Okta to work with JHipster: [https://youtu.be/Ktnvqoouulg](https://youtu.be/Ktnvqoouulg "https://youtu.be/Ktnvqoouulg"). ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 28, 2019, 1:28pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/7 "2019-05-28T13:28:49Z")
**Brian Demers** Hey Raul! Follow these same steps, but instead of an “ID Token” select "Access Token" [https://developer.okta.com/…](https://developer.okta.com/blog/2019/05/23/java-microservices-spring-cloud-config#create-groups-and-add-them-as-claims-to-the-id-token "https://developer.okta.com/blog/2019/05/23/java-microservices-spring-cloud-config#create-groups-and-add-them-as-claims-to-the-id-token") That will include the `groups` claim in the access token that is passed downstream to your service. ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 28, 2019, 3:37pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/8 "2019-05-28T15:37:34Z")
**keeps** I look in your repo and compare the code that i generated. it look a bit difference (e.g. your jhipster-registry:v5.0.0 and mine is 4.1.1) even-though my code just generated today using 6.0.1 generator. The app.jh is the same. Did i miss any steps? ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 28, 2019, 3:42pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/9 "2019-05-28T15:42:16Z")
**Raul Rotundo** Brian do you know how to set the “groups” claim using keycloak? I’m doing this using jhipster and keycloak with data generated by default and I can’t figure it out how to add the groups claim to the token and be able to resolve the @PreAuthorize problem that is how this start. I saw an open ticket in jhipster generator that may be related to this. [https://github.com/jhipster…](https://github.com/jhipster/generator-jhipster/issues/9735 "https://github.com/jhipster/generator-jhipster/issues/9735") ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 28, 2019, 4:27pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/10 "2019-05-28T16:27:38Z")
**Raul Rotundo** I resolved how to set “groups” claims to keycloak, basically what I did was go to Clients \> internal \> Mappers and add a groups claim by “Add Builtin” option. Now it’s present within the token `{sub=4c973896-5761-41fc-8217-07c5d13a004b, resource_access={“account”:{“roles”:[“manage-account”,“manage-account-links”,“view-profile”]}}, allowed-origins=[“http://localhost:8080/","http://localhost:8100/”,“http://127.0.0.1:8761/","http://localhost:9000/”], iss=http://keycloak:9080/auth/realms/jhipster, typ=Bearer, preferred_username=admin, acr=1, realm_access={“roles”:[“ROLE_USER”,“offline_access”,“ROLE_ADMIN”,“uma_authorization”]}, azp=web_app, auth_time=1559060498, scope=openid jhipster email offline_access profile address phone, exp=2019-05-28T16:26:38Z, session_state=93f33746-744c-4eaa-8ddb-bbb5ad6a9fa0, iat=2019-05-28T16:21:38Z, jti=acb2799e-8e0b-4583-a378-52ac3b2f2f4f, email=admin@localhost, email_verified=true, address={}, groups=[“ROLE_USER”,“offline_access”,“ROLE_ADMIN”,“uma_authorization”], given_name=Admin, aud=[account], nbf=1970-01-01T00:00:00Z, name=Admin Administrator, family_name=Administrator}` However, this change does not fix the issue related with @PreAuthorize annotation. Still having AUTHORIZATION\_FAILURE. ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [May 29, 2019, 3:06pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/11 "2019-05-29T15:06:26Z")
**Brian Demers** I’m not sure on the keycloak specifics, but assuming the access token is a JWT, with claims, you can add a `JwtAuthenticationConverter ` component, simialr to what we do for Okta: [https://github.com/okta/okt…](https://github.com/okta/okta-spring-boot/blob/f3b977de6de47bd9bb03a49c096c838bd980f99c/oauth2/src/main/java/com/okta/spring/boot/oauth/OktaJwtAuthenticationConverter.java#L25-L41 "https://github.com/okta/okta-spring-boot/blob/f3b977de6de47bd9bb03a49c096c838bd980f99c/oauth2/src/main/java/com/okta/spring/boot/oauth/OktaJwtAuthenticationConverter.java#L25-L41") Let us know how you make out! ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [June 6, 2019, 12:21pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/12 "2019-06-06T12:21:26Z")
**Raul Rotundo** Hi Brian, what I did to fix my @PreAuthorize problem was add a custom @PreAuthorize validation something like this article describe: [https://tuhrig.de/expressio…](https://tuhrig.de/expression-based-security-with-spring-security/ "https://tuhrig.de/expression-based-security-with-spring-security/") and then, mapping claims and set a boolean function to see if the role if present within realms\_access.roles or not. Maybe this solutions is not a good approach but at least resolved my main problem with Authorisations. Regards ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [June 6, 2019, 1:12pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/13 "2019-06-06T13:12:21Z")
**Matt Raible** I’m not sure why they would be different. If you run `jhipster --version`, does it say “6.0.1”? ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [July 7, 2019, 9:28pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/14 "2019-07-07T21:28:09Z")
**Biswadeep Basu** Hi Matt, Awesome tutorial! 🙂 Few queries, In the section where you mention "Give your app a memorable name, add [http://localhost:8080/login/oauth2/code/okta](http://localhost:8080/login/oauth2/code/okta) as a Login redirect" It does not work if I specify this as login url (Gives me a 404 when trying to login through the gateway app). Instead if I give the below login url it works. [http://localhost:8080/login/oauth2/code/oidc](http://localhost:8080/login/oauth2/code/oidc) Also, I see some strange error like “Request method ‘POST’ not supported” when using the app for the first time. Once restarted using decoker-compose restart, apis works fine. Additionally, every api (blog or store) for the first time throws a 504 time out of Hystrix. Any global config to set a higher time out value? ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [July 8, 2019, 11:30pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/15 "2019-07-08T23:30:34Z")
**Matt Raible** Hello Biswadeep, You are correct. There is a typo in this tutorial. The correct URL is “[http://localhost:8080/login/oauth2/code/oidc](http://localhost:8080/login/oauth2/code/oidc)”. I’m not sure how to fix the POST or 504 errors. I have seen them myself. I’ve opened [an issue on the JHipster project](https://github.com/jhipster/generator-jhipster/issues/10062 "https://github.com/jhipster/generator-jhipster/issues/10062") to investigate. ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [September 28, 2019, 3:09am UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/16 "2019-09-28T03:09:36Z")
**Azeem Mohammed** Hi Matt, Thanks for your tutorial. I have question. does jhipster supports spring Cloud gateway? ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [September 28, 2019, 3:50am UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/17 "2019-09-28T03:50:22Z")
**Matt Raible** No. Not yet. I hope to help integrate it soon though! It’s necessary for a full reactive stack. ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [November 9, 2019, 1:27pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/18 "2019-11-09T13:27:03Z")
**Hamzah Qureshi** Hi Matt, Thanks for the tutorial. I have followed it as it is except instead of using docker i am deploying everything locally. The problem i am facing is that, the users created in jhi-user table after logging in from okta credentials, those users are not assigned any roles. Due to which when i try to access any entity, i get “access denied” error. What could be the issue ? ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [November 9, 2019, 2:07pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/19 "2019-11-09T14:07:57Z")
**Matt Raible** You have to create ROLE\_ADMIN and ROLE\_USER groups on Okta, and then [add a “groups” claim to your ID token](https://developer.okta.com/blog/2019/05/23/java-microservices-spring-cloud-config#create-groups-and-add-them-as-claims-to-the-id-token "https://developer.okta.com/blog/2019/05/23/java-microservices-spring-cloud-config#create-groups-and-add-them-as-claims-to-the-id-token"). Then it will be synced by the [UserService#syncUserWithIdP()](https://github.com/jhipster/generator-jhipster/blob/master/generators/server/templates/src/main/java/package/service/UserService.java.ejs#L730 "https://github.com/jhipster/generator-jhipster/blob/master/generators/server/templates/src/main/java/package/service/UserService.java.ejs#L730") when you log in. ---
**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\ **Post date:** [November 23, 2019, 11:23pm UTC](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058/20 "2019-11-23T23:23:10Z")
**mxu** A bit off the topic, how much memory do I need to run the “docker-compose up”. It seems the blog and store apps could not start due to some memory or CPU constraints. I can see the Kibana (port 5601), port 8671 jhipster console and port 9080 Keycloak. But nothing on port 8080, 8081 and 8082. I am on a late 2012 model Macbook with 8gb memory. [Next page](https://devforum.okta.com/t/java-microservices-with-spring-cloud-config-and-jhipster/17058.md?page=2)