I’m planning on building a user management Java API and deploy it in Wildfly. The API specification will be done using Swagger.
Then I will create a Docker image with the Wildfly + application and then create a container from that image on AWS ECS (EC2 Container Service).
The next step is to import the API’s Swagger specification into AWS API Gateway and forward the requests to the created AWS ECS container.
My question. What is the best option to implement an OAuth2 server:
Create it on a new Java application (on the same or new Wildfly container), therefore not using the AWS API Gateway’s Custom Authorizer option? Is this even possible, since the requests will be received from AWS API Gateway? I ask this because when trying to import a Swagger specification with and OAuth2 security implementation, AWS API Gateway gives the following error:
Your API was not imported due to errors in the Swagger file. Unsupported security definition type 'oauth2' for 'oauth'. Ignoring.
As a side note, since all the future clients of the API will be developed by myself, I’m planning on using the Resource Owner Password Credentials Grant on my OAuth2 server.
I'm assuming 'Oauth2 Server' in your question means the thing that validates tokens. You don't state if your app is actually issuing tokens, or what type of tokens are issued.
Best option is probably subjective, but my preference has always been to use Custom Authorizers, as this is then a re-usable component for other resources.
Swagger imports into API Gateway aside, you can manage authorization in your app if you wanted to, it just becomes the first thing you deal with when a new request is received, just make sure the authorization header is mapped in API Gateway to head downstream.