search

IBMStockTrader / portfolio

Microservice implemented with MicroProfile that persists stock portfolios to JDBC (such as DB2)
Apache License 2.0
7 stars 60 forks source link

JWT should be used for all aspects of auth. (removal of static user registry from config) #16

Closed BarDweller closed 4 years ago

BarDweller commented 5 years ago

Currently the server is configured to accept JWTs, but also has a basic user registry with roles assigned and groups.

The roles should be coming from the JWT, to avoid embedding user ids and user roles within this service.

This service should only be validating the JWT, using the user id from within the token, and honoring the roles allowed by the token.

jwalcorn commented 4 years ago

I actually fixed this a long time ago, but forgot to close the issue.