Auth2 token multi server implementation

Support
1

Hi ,

We are currently experiencing an issue with our multi-server deployment.

We have deployed the application on two servers: Server-1 and Server-2. When an authentication token is requested from Server-1 and subsequently validated on Server-2, we receive an “access denied” error.

Since this multi-server implementation is a requirement, could you please advise on how we can achieve successful token validation across different servers?

2

Hi,

Could you please clarify whether this is an OAuth2/REST access token or a UI login session?

If this is a REST access token issued by the Jmix Authorization Server, both nodes must be able to validate the same token. The usual setup is:

  • Server-1 and Server-2 use the same database;
  • authorization data is not stored only in memory;
  • both nodes have the same security/client configuration and role assignments.

Please check that in-memory authorization service is not enabled:

jmix.authserver.use-in-memory-authorization-service=false

If the token is stored only in memory on Server-1, then Server-2 will not know anything about it and the request will be rejected.

If you use JWT tokens, then both servers must use the same issuer (e.g. KeyCloak issuer) and signing keys, or both should validate tokens from the same external identity provider.

If this is about UI login/session instead of REST tokens, then you should configure sticky sessions on the load balancer, because the Vaadin UI session should stay on the same node.

Regards,
Dmitry