OIDC and microservices current issues

This is a ticket to follow up #6514 and to help discussing with @danielpetisme @mraible @sendilkumarn who are all helping here.

• The current build is broken because we don’t have UserMapper in a microservice -> @mraible and @danielpetisme introduced a method to sync user data between the gateway and the microservices, which makes the microservices have a “User” object. However, if you choose to use DTOs (another entity which uses a DTO has a relationship to the User), this means you also need a UserMapper and a UserDTO, specific for microservices. This sounds quite complex to me!
• Once compilation is done, we also have a testing issue. The current code (if it compiled) would fail because resourceServerProperties.getJwt().getKeyUri() is not configured in the test resources application.yml file. Configuring it wouldn’t solve the issue: you need an OIDC server to do the tests. That’s also pretty bad, as this prevents us to do unit tests unless we run that server: as this works for monoliths without doing this, we need to check how it works for monoliths, and apply the same method to gateways and microservices.
• We need to test monoliths, gateways and microservices with Cassandra
• When doing a gateway + microservice: create an entity in the microservice, and then create its front-end on the gateway. There is a CSRF token issue that prevents write requests to work from the gateway to the microservice - I don’t know if we should pass the CSRF token or ignore it (not sure OIDC allows CSRF attacks)
• Swagger UI does not work with OAuth2
• When doing a monolith, and selecting JHipster Registry, we currently force the use of JWT. We should be able to use OAuth2 also.
• The JHipster Registry does not work with OIDC. We should do a specific Spring profile for OIDC.
• For microservice, we need to check that doing csrf().disabled() in the Spring Security configuration doesn’t cause a security risk

[jdubois]

So the big issues are fixed, I just added a new todo on a CSRF issue - I need to check this a little bit and we’ll probably end up removing CSRF on microservices (as it basically doesn’t make any sense)

[jdubois]

Closing as everything is done