service_invoke.scala

// call from web-gateway
// have a controller named MessageController with end point add message

def addMessage = Action.async { implicit rh =>
        messageService.addMessage
          .handleRequestHeader(ResourceClientSecurity.authenticate())
          .invoke(rh.body.asJson.get.as[Message])
          .map {
            msg => Ok("")
    }
  }

// ResourceClientSecurity in security project which is shared with all project to authentication headers

object ResourceClientSecurity {

  /**
    * Authenticate a resource client request.
    */
  def authenticate(): RequestHeader => RequestHeader = { requestHeader =>

    requestHeader.getHeader("X-Auth-Token") match {
      case Some(token) =>
          val requestWithPrincipal = requestHeader.withPrincipal(UserPrincipal.of(token, requestHeader.principal))
          SecurityHeaderFilter.transformClientRequest(requestWithPrincipal)
      case other =>
          throw Forbidden("User not authenticated")
    }
  }
}

// addmessage in message service implementation
override def addMessage() =
    ResourceServerSecurity.authenticated((authKey, rh) => ServerServiceCall { msg =>
      
    rh.addHeader("serviceId", "123")
    keeperService.authorize
      .handleRequestHeader(KeeperClientSecurity.authenticate())
      .invoke("")
      .map { e =>
        new OAuthSubject(e)
      }
      
      val subject = for {
        subject <- handler.getSubject(rh)
      } yield subject
      subject.flatMap { oAuthSubject =>
        (oAuthSubject.roles, oAuthSubject.permissions) match {
          case (Seq(UserRole("user")), Seq(UserPermission("add"))) =>
            val msgUid = UUID.randomUUID()
            refFor(msgUid.toString).ask(AddMessage(msg.copy(id = msgUid))).map { _ => null }
          case others => throw Forbidden("user not authorised")
        }
      }
   })
                                                                                             
 // Resource server security 

object ResourceServerSecurity {

  def authenticated[Req, Response](serviceCall: String => ServerServiceCall[Req, Response]) =

    ServerServiceCall.compose { requestHeader =>
      val request = SecurityHeaderFilter.transformServerRequest(requestHeader)
      request.principal match {
        case Some(userPrincipal: UserPrincipal) =>
          serviceCall(userPrincipal.authKey, requestHeader)
        case other =>
          throw Forbidden("User not authenticated")
      }
    }
}

      val subject = for {
        subject <- handler.getSubject(rh)
      } yield subject

This for-comprension isn't really doing anything. It's equivalent to val subject = handler.getSubject(rh).