How integrate armeria with spring-security

[evgeny-mordyasov]

I have two microservices. They have a REST API on armeria. I would like to enable spring-security for my application. But spring-security works with tomcat. I tried using the 'spring-boot-tomcat' example from https://github.com/line/armeria-examples. Yes, it does work, but for REST services described using spring-web. If I want to extend security to REST services described with armeria, they don't work. Is there a solution for this? If yes, please share.

[trustin]

Because Spring Security works only at the Spring layer, it will not affect the REST services written in Armeria API unfortunately. There are two options here:

1. Replace Spring Security with Armeria's AuthService and/or CorsService.
   • If you're using Spring Security for relatively simple scenarious, you could easily migrate to Armeria's authn/z decorators. Please feel free to let us know what features of Spring Security you're using, then we'd be happy to provide more assistance.
   • This option is recommended when you have a plan to use other Armeria services, such as gRPC and GraphQL.
2. Migrate the existing Armeria API REST services to Spring Web, so that Spring Security is applied to all services you run.

Given Spring Security is tightly coupled with Spring Framework, it would be unrealistic to make Spring Security to support at Armeria decorator level, but please feel free to correct me - I'd be happy to reinvestigate whether it's a feasible idea or not.

[evgeny-mordyasov]

Thank you for the quick answer. I assumed that it is hardly possible to cross Armeria and Spring Security at the moment. Therefore, I wanted to hear for sure if this is the case. I did not know about the existence of AuthService, so I will strive in this direction. Thanks again!