# Pass authorization from microservice to microservice

**URL:** <https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395>\
**Category:** Forum\
**Tags:** datahub, cumulocity\
**Created:** [June 26, 2024, 7:08am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395 "2024-06-26T07:08:56Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![David.Richter](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@David.Richter](https://community.cumulocity.com/u/David.Richter)\
**Post date:** [June 26, 2024, 7:08am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/1 "2024-06-26T07:08:56Z")

</div>

Hi guys,

this is my scenario. I have a frontend (cockpit). This talks to my microservice. This microservice should talk to the datahub microservice. To do this I need something to authorise against the datahub microservice.

My first idea was to extract the Authorization-Token from HTTP-Request and use this for query the datahub service. This was working good when I local send some request with the Authorization-Token against my microservice. But now I see the request that the frontend send don’t use Authorization-Token. Instead it use a cookie.

So now I’m experimenting with the MicroserviceSubscriptionsService and the ContextService from cumulocity but I don’t find a away to pass the authorization from my microservice to the datahub microservice.

Any ideas how to make it?

---

<div class="post-metadata">

**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\
**Post date:** [June 26, 2024, 8:59am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/2 "2024-06-26T08:59:38Z")

</div>

What do you mean with “datahub microservice” ? It that a own implemented microservice? Does it expose any REST endpoints? Or is the just the API documented here: [Cumulocity IoT DataHub - OpenAPI Specification](https://cumulocity.com/api/datahub/)

Normally a service user is used to access the API but I understood your use case that you want to use the user-authenticated context, correct?

You can retrieve the context information using the context service

```auto
    @Autowired
    private ContextService<UserCredentials> contextService;
    ....
    contextService.getContext().getUsername();
    contextService.getContext().getPassword();
    ....

```

These credentials can be passed to a REST endpoint (Auth Header) that is provided by your datahub microservice. Finally you have that context information and can make your calls.

Using service user you don’t need that complex architecture at all. You would just use the service user of your data-hub microservice to access the data-hub API.

---

<div class="post-metadata">

**Author:** ![David.Richter](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@David.Richter](https://community.cumulocity.com/u/David.Richter)\
**Post date:** [June 26, 2024, 11:15am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/3 "2024-06-26T11:15:59Z")

</div>

Hi,

yes I mean the datahub microservice of Software AG that is documented here: [Cumulocity IoT DataHub - OpenAPI Specification](https://cumulocity.com/api/datahub)

What do you mean with service user? Do you mean the bootstrap user of my microservice?

When I try what is describt here [Authentication](https://cumulocity.com/api/datahub/#section/Authentication) with the credentials of my bootstrap user I get a HTTP 403 back when I request the datehub microservice. When I do this with my normal credentials I get the date I expect back.

Do I have to give my microservice some special roles that he can request the datahub microservice with the bootstrap user?

---

<div class="post-metadata">

**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\
**Post date:** [June 26, 2024, 11:26am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/4 "2024-06-26T11:26:37Z")

</div>

Hi,

ok, you could just use the service user of the microservice then. The service user is a generated user which is created when you subscribe a microservice to a tenant. The bootstrap user is just a user to retrieve the service user. In your cumulocity.json manifest you have to define which roles this service user has. Here you need to add DATAHUB\_ADMINISTRATOR **OR** DATAHUB\_MANAGER **OR** DATAHUB\_READER.

[General aspects - Cumulocity documentation](https://cumulocity.com/docs/microservice-sdk/general-aspects/#microservice-manifest) see required roles.  
Now you only need to make sure you are running in a service user context using MicroserviceSubscriptionService (service user credenrtials will be fetched automatically, you don’t need to authenticate etc.)

```auto
subscriptionsService.runForEachTenant(() -> {
...
<calling Data Hub API using RestConnector>
});

```

or you follow the approach above which will use the user you authenticated with in Cumulocity and call the data hub API with that

```auto
    @Autowired(required = true)
    @Qualifier("userPlatform")
    private Platform platformApi;

    platformApi.rest().post(...)

```

---

<div class="post-metadata">

**Author:** ![David.Richter](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@David.Richter](https://community.cumulocity.com/u/David.Richter)\
**Post date:** [June 26, 2024, 12:56pm UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/5 "2024-06-26T12:56:28Z")

</div>

The problem that I have with RestConnector or with RestOperation is that its return a ResourceRepresentation and I expect only a JSON String. So I try to use the RestTemplate from spring but there I have problems to authorize against the microservice.

---

<div class="post-metadata">

**Author:** ![Harald\_Meyer](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/harald_meyer/32/1959_2.png) [@Harald\_Meyer](https://community.cumulocity.com/u/Harald_Meyer)\
**Post date:** [June 26, 2024, 1:33pm UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/6 "2024-06-26T13:33:02Z")

</div>

Hi David,

if you want to use RestTemplate, you can get the credentials as a header:

```auto
subscriptionsService.runForEachTenant(() -> {
     String credentials = subscriptionsService.getCredentials(subscriptionsService.getTenant()).get().toCumulocityCredentials().getAuthenticationString();
     HttpHeaders headers = new HttpHeaders();
     headers.add("Authorization", credentials);
     HttpEntity<String> request = new HttpEntity<String>(headers);
     // do the POST request using the headers
});

```

---

<div class="post-metadata">

**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\
**Post date:** [June 26, 2024, 1:49pm UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/7 "2024-06-26T13:49:43Z")

</div>

In addition to Haralds post: The example posted is using the service user with the roles you have defined in your manifest. So make sure Datahub roles are part of it.

---

<div class="post-metadata">

**Author:** ![David.Richter](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@David.Richter](https://community.cumulocity.com/u/David.Richter)\
**Post date:** [June 27, 2024, 5:27am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/8 "2024-06-27T05:27:05Z")

</div>

The way that @Harald_Meyer mentioned works for me but I know its not the best practices way. It would be intresting to know how to get the credentials for the service user but I guess this is not so easy.

---

<div class="post-metadata">

**Author:** ![Harald\_Meyer](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/harald_meyer/32/1959_2.png) [@Harald\_Meyer](https://community.cumulocity.com/u/Harald_Meyer)\
**Post date:** [June 27, 2024, 5:46am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/9 "2024-06-27T05:46:43Z")

</div>

Hi @David.Richter

actually this is the service user. If you skip the “getAuthenticationString()” at the end you get a [CumulocityCredentials](https://resources.cumulocity.com/documentation/javasdk/current/com/cumulocity/model/authentication/CumulocityCredentials.html) object that you can work with.

---

<div class="post-metadata">

**Author:** ![David.Richter](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@David.Richter](https://community.cumulocity.com/u/David.Richter)\
**Post date:** [June 27, 2024, 7:37am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/10 "2024-06-27T07:37:14Z")

</div>

Ah thanks for the clarification. Then everything works how it should.  
Thank you

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/system/32/31990_2.png) [@system](https://community.cumulocity.com/u/system)\
**Post date:** [December 24, 2024, 7:38am UTC](https://community.cumulocity.com/t/pass-authorization-from-microservice-to-microservice/1395/11 "2024-12-24T07:38:02Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.