Kotlin / Gradle

Micronaut Token Propagation

Learn how to leverage token propagation in the Micronaut framework to simplify your code while keeping your microservices secure.

Sergio del Amo

On this guide

In this section

Getting Started

Let’s describe the microservices you will build through the guide.

gateway - A microservice secured via JWT that exposes an endpoint /user. The output of that endpoint is the result of consuming the userecho endpoint.
userecho - A microservice secured via JWT that exposes an endpoint /user that responds with the username of the authenticated user.

The next diagram illustrates the flow:

We generate a valid JWT in the gateway microservice. Then every microservice in our application is able to validate this JWT. We want every internal request to contain a valid JWT token. If we want to talk to another microservice we need to propagate the valid JWT get received.

Setup IntelliJ IDEA to develop Micronaut Applications.

What you will need

To complete this guide, you will need the following:

Some time on your hands
A decent text editor or IDE (e.g. IntelliJ IDEA)
JDK 21 or greater installed with JAVA_HOME configured appropriately

Solution

We recommend that you follow the instructions in the next sections and create the application step by step. However, you can go right to the completed example.

Download and unzip the source

Writing the Application

We will write the application first without token propagation. Then we will configure token propagation, and you will see how much code we can remove.

Gateway

Create the microservice:

mn create-app example.micronaut.gateway --build=gradle --lang=kotlin

Add the security-jwt module to the configuration:

build.gradle

kapt("io.micronaut.security:micronaut-security-processor")
implementation("io.micronaut.security:micronaut-security-jwt")

To keep this guide simple, create a naive AuthenticationProvider to simulate user’s authentication.

intermediate-gateway/kotlin/src/main/kotlin/example/micronaut/AuthenticationProviderUserPassword.kt

package example.micronaut

import io.micronaut.http.HttpRequest
import io.micronaut.security.authentication.AuthenticationFailureReason
import io.micronaut.security.authentication.AuthenticationRequest
import io.micronaut.security.authentication.AuthenticationResponse
import io.micronaut.security.authentication.provider.HttpRequestAuthenticationProvider
import jakarta.inject.Singleton

@Singleton // 
class AuthenticationProviderUserPassword<B : Any> : HttpRequestAuthenticationProvider<B> { // 
    override fun authenticate(
        requestContext: HttpRequest<B>?,
        authenticationRequest: AuthenticationRequest<String?, String?>
    ): AuthenticationResponse {
        return if ((authenticationRequest.identity == "sherlock" || authenticationRequest.identity == "watson") && authenticationRequest.secret == "password")
            AuthenticationResponse.success(authenticationRequest.identity!!) else
            AuthenticationResponse.failure(AuthenticationFailureReason.CREDENTIALS_DO_NOT_MATCH)
    }
}

1	Use `jakarta.inject.Singleton` to designate a class as a singleton.
2	A Micronaut Authentication Provider implements the interface `io.micronaut.security.authentication.provider.HttpRequestAuthenticationProvider`.

Create a class UserController that exposes the /user endpoint.

intermediate-gateway/kotlin/src/main/kotlin/example/micronaut/UserController.kt

package example.micronaut

import io.micronaut.http.MediaType.TEXT_PLAIN
import io.micronaut.http.annotation.Controller
import io.micronaut.http.annotation.Get
import io.micronaut.http.annotation.Header
import io.micronaut.http.annotation.Produces
import io.micronaut.security.annotation.Secured
import io.micronaut.security.rules.SecurityRule.IS_AUTHENTICATED
import reactor.core.publisher.Mono

@Controller("/user") // 
class UserController(private val usernameFetcher: UsernameFetcher) { // 

    @Secured(IS_AUTHENTICATED) // 
    @Produces(TEXT_PLAIN) // 
    @Get // 
    fun index(@Header("Authorization") authorization: String): Mono<String> = // 
            usernameFetcher.findUsername(authorization)
}

1	Annotate with `io.micronaut.http.annotation.Controller` to designate the class as a Micronaut controller.
2	Constructor dependency injection
3	Annotate with `io.micronaut.security.Secured` to configure secured access. The `isAuthenticated()` expression will allow access only to authenticated users.
4	Since we return a string which is not valid JSON, set the media type to `text/plain`.
5	You can specify the HTTP verb that a controller action responds to. To respond to a GET request, use the `io.micronaut.http.annotation.Get` annotation.
6	You can bind an HTTP header to a controller method argument.

Create an interface to encapsulate the collaboration with the userecho microservice.

intermediate-gateway/kotlin/src/main/kotlin/example/micronaut/UsernameFetcher.kt

package example.micronaut

import io.micronaut.http.annotation.Header
import reactor.core.publisher.Mono

interface UsernameFetcher {
    fun findUsername(@Header("Authorization") authorization: String): Mono<String>
}

Create a Micronaut HTTP Declarative client:

intermediate-gateway/kotlin/src/main/kotlin/example/micronaut/UserEchoClient.kt

package example.micronaut

import io.micronaut.context.annotation.Requires
import io.micronaut.context.env.Environment.TEST
import io.micronaut.http.MediaType.TEXT_PLAIN
import io.micronaut.http.annotation.Consumes
import io.micronaut.http.annotation.Get
import io.micronaut.http.annotation.Header
import io.micronaut.http.client.annotation.Client
import reactor.core.publisher.Mono

@Client(id = "userecho") // 
@Requires(notEnv = [TEST]) // 
interface UserEchoClient : UsernameFetcher {

    @Consumes(TEXT_PLAIN)
    @Get("/user") // 
    override fun findUsername(@Header("Authorization") authorization: String): Mono<String> // 
}

1	The `@Client` annotation is used with a service id. We will reference the exact service id in the configuration shortly.
2	Don’t load this bean in the `test` environment.
3	Use `@Get` annotation to define the client mapping
4	Supply the JWT to the HTTP Authorization header value to the `@Client` method.

Add this snippet to application.properties to configure the service URL of the echo service

intermediate-gateway/src/main/resources/application.properties

# 
micronaut.http.services.userecho.urls[0]=http://localhost:8081

1	This is the same service ID we used in the `@Client` annotation.
2	Configure a URL where the `userecho` microservice resides.

Add this snippet to application.properties to configure security:

intermediate-gateway/src/main/resources/application.properties

micronaut.security.authentication=bearer 
# 
micronaut.security.token.jwt.signatures.secret.generator.secret="${JWT_GENERATOR_SIGNATURE_SECRET:pleaseChangeThisSecretForANewOne}"

1	Set `authentication` to `bearer` to receive a JSON response from the login endpoint.
2	You can create a SecretSignatureConfiguration named generator via configuration as illustrated above. The generator signature is used to sign the issued JWT claims.
3	Change this to your own secret and keep it safe (do not store this in your VCS)

Tests

Provide a UsernameFetcher bean replacement for the Test environment.

intermediate-gateway/kotlin/src/test/kotlin/example/micronaut/UserEchoClientReplacement.kt

package example.micronaut

import io.micronaut.context.annotation.Requires
import io.micronaut.context.env.Environment.TEST
import io.micronaut.http.annotation.Header
import jakarta.inject.Singleton
import reactor.core.publisher.Mono

@Requires(env = [TEST])
@Singleton
class UserEchoClientReplacement : UsernameFetcher {

    override fun findUsername(@Header("Authorization") authorization: String): Mono<String> =
            Mono.just("sherlock")
}

Create tests to verify the application is secured and we can access it after login:

intermediate-gateway/kotlin/src/test/kotlin/example/micronaut/UserControllerTest.kt

package example.micronaut

import io.micronaut.http.HttpRequest
import io.micronaut.http.HttpStatus.UNAUTHORIZED
import io.micronaut.http.client.HttpClient
import io.micronaut.http.client.annotation.Client
import io.micronaut.http.client.exceptions.HttpClientResponseException
import io.micronaut.security.authentication.UsernamePasswordCredentials
import io.micronaut.security.token.render.BearerAccessRefreshToken
import io.micronaut.test.extensions.junit5.annotation.MicronautTest
import jakarta.inject.Inject
import org.junit.jupiter.api.Assertions.assertEquals
import org.junit.jupiter.api.Assertions.assertThrows
import org.junit.jupiter.api.Test

@MicronautTest // 
class UserControllerTest(@Client("/") val client: HttpClient) { // 

    @Test
    fun testUserEndpointIsSecured() { // 
        val thrown = assertThrows(HttpClientResponseException::class.java) {
            client.toBlocking().exchange<Any, Any>(HttpRequest.GET("/user"))
        }
        assertEquals(UNAUTHORIZED, thrown.response.status)
    }

    @Test
    fun testAuthenticatedCanFetchUsername() {
        val credentials = UsernamePasswordCredentials("sherlock", "password")
        val request: HttpRequest<*> = HttpRequest.POST("/login", credentials)
        val bearerAccessRefreshToken = client.toBlocking().retrieve(request, BearerAccessRefreshToken::class.java)
        val username = client.toBlocking()
                .retrieve(HttpRequest.GET<Any>("/user")
                        .header("Authorization", "Bearer " + bearerAccessRefreshToken.accessToken), String::class.java)
        assertEquals("sherlock", username)
    }
}

1	Annotate the class with `@MicronautTest` so the Micronaut framework will initialize the application context and the embedded server. More info.
2	Inject the `HttpClient` bean and point it to the embedded server.
3	Test endpoint is secured

User echo

Create the microservice:

mn create-app example.micronaut.userecho --build=gradle --lang=kotlin

Add the security-jwt module to the configuration:

build.gradle

kapt("io.micronaut.security:micronaut-security-processor")
implementation("io.micronaut.security:micronaut-security-jwt")

Create a class UserController that exposes the /user endpoint.

intermediate-userecho/kotlin/src/main/kotlin/example/micronaut/UserController.kt

package example.micronaut

import io.micronaut.http.MediaType.TEXT_PLAIN
import io.micronaut.http.annotation.Controller
import io.micronaut.http.annotation.Get
import io.micronaut.http.annotation.Produces
import io.micronaut.security.annotation.Secured
import io.micronaut.security.rules.SecurityRule.IS_AUTHENTICATED
import java.security.Principal

@Controller("/user") // 
class UserController {

    @Secured(IS_AUTHENTICATED) // 
    @Produces(TEXT_PLAIN) // 
    @Get // 
    fun index(principal: Principal): String = principal.name // 
}

1	Annotate with `io.micronaut.http.annotation.Controller` to designate the class as a Micronaut controller.
2	Annotate with `io.micronaut.security.Secured` to configure secured access. The `isAuthenticated()` expression will allow access only to authenticated users.
3	Since we return a string which is not valid JSON, set the media type to `text/plain`.
4	You can specify the HTTP verb that a controller action responds to. To respond to a GET request, use the `io.micronaut.http.annotation.Get` annotation.
5	If a user is authenticated, the Micronaut framework will bind the user object to an argument of type `java.security.Principal` (if present).

Add this snippet to application.properties to change the port where userecho starts:

intermediate-userecho/src/main/resources/application.properties

micronaut.server.port=8081

1	Configure the port where the application listens.

Add this snippet to application.properties

intermediate-userecho/src/main/resources/application.properties

# 
micronaut.security.token.jwt.signatures.secret.validation.secret="${JWT_GENERATOR_SIGNATURE_SECRET:pleaseChangeThisSecretForANewOne}"

1	You can create a `SecretSignatureConfiguration` named `validation` that can validate JWTs generated by the `gateway` microservice.
2	Change this to your own secret and keep it safe (do not store this in your VCS)

Token Propagation

As you can see, propagating the JWT token to other microservices in our application complicates the code. We need to capture the Authorization header in the controller method arguments and then pass it to the @Client bean. In an application with several controllers and declarative clients, it can lead to a lot of repetition. Fortunately, the Framework includes a feature called token propagation. We can tell our application to propagate the incoming token to a set of outgoing requests.

Let’s configure token propagation. We need to modify application.properties in the gateway microservice:

gateway/src/main/resources/application.properties

micronaut.security.token.propagation.enabled=true 
micronaut.security.token.propagation.service-id-regex=userecho

1	Enable token propagation
2	We only want to propagate the token to certain services. We can create a regular expression to match those services ids.

We can simplify the code:

Edit UserController.java and remove the @Header parameter:

gateway/kotlin/src/main/kotlin/example/micronaut/UserController.kt

package example.micronaut

import io.micronaut.http.MediaType.TEXT_PLAIN
import io.micronaut.http.annotation.Controller
import io.micronaut.http.annotation.Get
import io.micronaut.http.annotation.Produces
import io.micronaut.security.annotation.Secured
import io.micronaut.security.rules.SecurityRule.IS_AUTHENTICATED
import reactor.core.publisher.Mono

@Controller("/user")
class UserController(private val usernameFetcher: UsernameFetcher) {

    @Secured(IS_AUTHENTICATED)
    @Produces(TEXT_PLAIN)
    @Get
    fun index(): Mono<String> = usernameFetcher.findUsername()
}

Edit UsernameFetcher.java and remove the @Header parameter:

gateway/kotlin/src/main/kotlin/example/micronaut/UsernameFetcher.kt

package example.micronaut

import reactor.core.publisher.Mono

interface UsernameFetcher {
    fun findUsername(): Mono<String>
}

Edit UserEchoClient.java and remove the @Header parameter:

gateway/kotlin/src/main/kotlin/example/micronaut/UserEchoClient.kt

package example.micronaut

import io.micronaut.context.annotation.Requires
import io.micronaut.context.env.Environment.TEST
import io.micronaut.http.MediaType.TEXT_PLAIN
import io.micronaut.http.annotation.Consumes
import io.micronaut.http.annotation.Get
import io.micronaut.http.client.annotation.Client
import reactor.core.publisher.Mono

@Client(id = "userecho")
@Requires(notEnv = [TEST])
interface UserEchoClient : UsernameFetcher {

    @Consumes(TEXT_PLAIN)
    @Get("/user")
    override fun findUsername(): Mono<String>
}

Edit UserEchoClientReplacement.java and remove the @Header parameter:

gateway/kotlin/src/test/kotlin/example/micronaut/UserEchoClientReplacement.kt

package example.micronaut

import io.micronaut.context.annotation.Requires
import io.micronaut.context.env.Environment.TEST
import jakarta.inject.Singleton
import reactor.core.publisher.Mono

@Requires(env = [TEST])
@Singleton
class UserEchoClientReplacement : UsernameFetcher {

    override fun findUsername(): Mono<String> = Mono.just("sherlock")
}

Running the App

Run both microservices:

userecho

./gradlew run

18:29:26.500 [main] INFO  io.micronaut.runtime.Micronaut - Startup completed in 671ms. Server Running: http://localhost:8081

gateway

./gradlew run

18:28:35.723 [main] INFO  io.micronaut.runtime.Micronaut - Startup completed in 707ms. Server Running: http://localhost:8080

Send a curl request to authenticate:

curl -X "POST" "http://localhost:8080/login" \
     -H 'Content-Type: application/json; charset=utf-8' \
     -d $'{"username": "sherlock", "password": "password"}'

{"username":"sherlock","access_token":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzaGVybG9jayIsIm5iZiI6MTYxNTkxMDM3Nywicm9sZXMiOltdLCJpc3MiOiJnYXRld2F5IiwiZXhwIjoxNjE1OTEzOTc3LCJpYXQiOjE2MTU5MTAzNzd9.nWoaNq9YzRzYKDBvDw_QaiUyVyIoc6rHCW_vLfnrtQ8","token_type":"Bearer","expires_in":3600}

Now you can call the /user endpoint supplying the access token in the Authorization header.

curl "http://localhost:8080/user" -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzaGVybG9jayIsIm5iZiI6MTYxNTkxMDM3Nywicm9sZXMiOltdLCJpc3MiOiJnYXRld2F5IiwiZXhwIjoxNjE1OTEzOTc3LCJpYXQiOjE2MTU5MTAzNzd9.nWoaNq9YzRzYKDBvDw_QaiUyVyIoc6rHCW_vLfnrtQ8'

sherlock

Generate a Micronaut Application Native Executable with GraalVM

We will use GraalVM, an advanced JDK with ahead-of-time Native Image compilation, to generate a native executable of this Micronaut application.

Compiling Micronaut applications ahead of time with GraalVM significantly improves startup time and reduces the memory footprint of JVM-based applications.

Note	Only Java and Kotlin projects support using GraalVM’s `native-image` tool. Groovy relies heavily on reflection, which is only partially supported by GraalVM.

GraalVM Installation

The easiest way to install GraalVM on Linux or Mac is to use SDKMan.io.

Java 25

sdk install java 25.0.2-graal

For installation on Windows, or for a manual installation on Linux or Mac, see the GraalVM Getting Started documentation.

The previous command installs Oracle GraalVM, which is free to use in production and free to redistribute, at no cost, under the GraalVM Free Terms and Conditions.

Alternatively, you can use the GraalVM Community Edition:

Java 25

sdk install java 25.0.2-graalce

Native Executable Generation

To generate a native executable using Gradle, run:

./gradlew nativeCompile

The native executable is created in build/native/nativeCompile directory and can be run with build/native/nativeCompile/micronautguide.

It is possible to customize the name of the native executable or pass additional parameters to GraalVM:

build.gradle

graalvmNative {
    binaries {
        main {
            imageName.set('mn-graalvm-application') // 
            buildArgs.add('-Ob') // 
        }
    }
}

1	The native executable name will now be `mn-graalvm-application`
2	It is possible to pass extra build arguments to `native-image`. For example, `-Ob` enables the quick build mode.

After creating the native executables for both microservices, start them and send the same curl requests as before to check that everything works using GraalVM native executables.

Next Steps

Read more about Token Propagation and Micronaut Security.

Help with the Micronaut Framework

The Micronaut Foundation sponsored the creation of this Guide. A variety of consulting and support services are available.

License

Note	All guides are released with an Apache License 2.0 for the code and a Creative Commons Attribution 4.0 license for the writing and media (images).