title: how to implement role-based security in microservices architecture
body: <p>I have a spring-boot application with 4 microservices, eureka server and a centralized API gateway.</p>
  <p>All external traffic is coming via my API gateway to my microservices.</p>
  <p>My API gateway (Zuul) is validating and verifying JWT token.</p>
  <p>the JWT token is generated by one of my microservices after user login (the users microservice), the token contain the user Id and his roles/authorities.</p>
  <p>Now I want to implement role-based security on methods that are present in microservices other than the gateway.</p>
  <p>I have tried to use <code>@PreAuthorize</code> but it's not working out of the gateway (obviously in order to make it work I have to set a Spring Security authentication object in the <code>SecurityContextHolder</code> in my microservices and populate it with authorities).</p>
  <p>So is there any solution to achieve this type of security?</p>
  <p>What is the best design to set up security in microservice architecture?</p>
  <p>Authentication at API gateway level and authorization at microservices level?</p>
  <p>Do I need to use spring security within the microservices or just pass down the roles (append them to the request) after validating the JWT at API gateway level and for example create my own annotations and use Spring AOP to handle authorization?</p>