OAuth 2.0 资源服务器 JWT

JWT 的最小依赖项

大多数 Resource Server 支持都收集到spring-security-oauth2-resource-server. 但是，对解码和验证 JWT 的支持在spring-security-oauth2-jose，这意味着两者都是拥有支持 JWT 编码的 Bearer Token 的工作资源服务器所必需的。spring-doc.cadn.net.cn

JWT 的最低配置

使用 Spring Boot 时，将应用程序配置为资源服务器包括两个基本步骤。首先，包含所需的依赖项。其次，指示授权服务器的位置。spring-doc.cadn.net.cn

指定 Authorization Server

在 Spring Boot 应用程序中，您需要指定要使用的授权服务器：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://idp.example.com/issuer

哪里idp.example.com/issuer是issAuthorization Server 颁发的 JWT 令牌的声明。此资源服务器使用此属性进一步进行自我配置、发现授权服务器的公钥，并随后验证传入的 JWT。spring-doc.cadn.net.cn

要使用issuer-uriproperty 中，还必须是idp.example.com/issuer/.well-known/openid-configuration,idp.example.com/.well-known/openid-configuration/issuer或idp.example.com/.well-known/oauth-authorization-server/issuer是授权服务器支持的端点。此端点称为 Provider Configuration 端点或 Authorization Server Metadata 端点。spring-doc.cadn.net.cn

创业期望

使用此属性和这些依赖项时，Resource Server 会自动将自身配置为验证 JWT 编码的 Bearer Tokens。spring-doc.cadn.net.cn

它通过确定性启动过程来实现这一点：spring-doc.cadn.net.cn

点击 Provider Configuration 或 Authorization Server Metadata 端点，处理jwks_url财产。spring-doc.cadn.net.cn
配置验证策略以查询jwks_url获取有效的公钥。spring-doc.cadn.net.cn
配置验证策略以验证每个 JWT 的iss索赔idp.example.com.spring-doc.cadn.net.cn

此过程的结果是，授权服务器必须接收请求，Resource Server 才能成功启动。spring-doc.cadn.net.cn

如果授权服务器在 Resource Server 查询时已关闭（给定适当的超时），则启动将失败。spring-doc.cadn.net.cn

运行时预期

应用程序启动后，Resource Server 会尝试处理任何包含Authorization: Bearer页眉：spring-doc.cadn.net.cn

GET / HTTP/1.1
Authorization: Bearer some-token-value # Resource Server will process this

只要指示此方案，Resource Server 就会尝试根据 Bearer Token 规范处理请求。spring-doc.cadn.net.cn

给定格式正确的 JWT，Resource Server：spring-doc.cadn.net.cn

根据从jwks_urlendpoint 的 intent 匹配，并与 JWTs 标头匹配。spring-doc.cadn.net.cn
验证 JWTexp和nbftimestamp 和 JWTiss索赔。spring-doc.cadn.net.cn
将每个范围映射到带有前缀SCOPE_.spring-doc.cadn.net.cn

当授权服务器提供新密钥时， Spring Security 会自动轮换用于验证 JWT 令牌的密钥。spring-doc.cadn.net.cn

默认情况下，生成的Authentication#getPrincipal是 Spring SecurityJwtobject 和Authentication#getName映射到 JWT 的sub属性（如果存在）。spring-doc.cadn.net.cn

从这里，考虑跳到：spring-doc.cadn.net.cn

直接指定授权服务器 JWK 集 URI

如果授权服务器不支持任何配置端点，或者如果 Resource Server 必须能够独立于授权服务器启动，则可以提供jwk-set-uri也：spring-doc.cadn.net.cn

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://idp.example.com
          jwk-set-uri: https://idp.example.com/.well-known/jwks.json

JWK 集 URI 未标准化，但您通常可以在授权服务器的文档中找到它。spring-doc.cadn.net.cn

因此，Resource Server 在启动时不会 ping 授权服务器。我们仍然指定issuer-uri，以便 Resource Server 仍会验证iss对传入的 JWT 的声明。spring-doc.cadn.net.cn

您可以直接在 DSL 上提供此属性。spring-doc.cadn.net.cn

覆盖或替换引导自动配置

Spring Boot 生成两个@Bean对象。spring-doc.cadn.net.cn

第一个 bean 是一个SecurityWebFilterChain，将应用程序配置为资源服务器。当包含spring-security-oauth2-jose这SecurityWebFilterChain看来：spring-doc.cadn.net.cn

资源服务器安全性WebFilterChain

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		.authorizeExchange(exchanges -> exchanges
			.anyExchange().authenticated()
		)
		.oauth2ResourceServer(OAuth2ResourceServerSpec::jwt)
	return http.build();
}

@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        authorizeExchange {
            authorize(anyExchange, authenticated)
        }
        oauth2ResourceServer {
            jwt { }
        }
    }
}

如果应用程序未公开SecurityWebFilterChainbean，Spring Boot 公开了默认的（如前面的清单所示）。spring-doc.cadn.net.cn

要替换它，请公开@Bean在应用程序中：spring-doc.cadn.net.cn

替换 SecurityWebFilterChain

Javaspring-doc.cadn.net.cn
Kotlinspring-doc.cadn.net.cn

import static org.springframework.security.oauth2.core.authorization.OAuth2ReactiveAuthorizationManagers.hasScope;

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		.authorizeExchange(exchanges -> exchanges
			.pathMatchers("/message/**").access(hasScope("message:read"))
			.anyExchange().authenticated()
		)
		.oauth2ResourceServer(oauth2 -> oauth2
			.jwt(withDefaults())
		);
	return http.build();
}





import org.springframework.security.oauth2.core.authorization.OAuth2ReactiveAuthorizationManagers.hasScope

@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        authorizeExchange {
            authorize("/message/**", hasScope("message:read"))
            authorize(anyExchange, authenticated)
        }
        oauth2ResourceServer {
            jwt { }
        }
    }
}



The preceding configuration requires the scope of message:read for any URL that starts with /messages/.spring-doc.cadn.net.cn


Methods on the oauth2ResourceServer DSL also override or replace auto configuration.spring-doc.cadn.net.cn


For example, the second @Bean Spring Boot creates is a ReactiveJwtDecoder, which decodes String tokens into validated instances of Jwt:spring-doc.cadn.net.cn


ReactiveJwtDecoder




Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
public ReactiveJwtDecoder jwtDecoder() {
    return ReactiveJwtDecoders.fromIssuerLocation(issuerUri);
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return ReactiveJwtDecoders.fromIssuerLocation(issuerUri)
}













Calling ReactiveJwtDecoders#fromIssuerLocation invokes the Provider Configuration or Authorization Server Metadata endpoint to derive the JWK Set URI.
If the application does not expose a ReactiveJwtDecoder bean, Spring Boot exposes the above default one.spring-doc.cadn.net.cn






Its configuration can be overridden by using jwkSetUri() or replaced by using decoder().spring-doc.cadn.net.cn


Using jwkSetUri()

You can configure an authorization server’s JWK Set URI as a configuration property or supply it in the DSL:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		.authorizeExchange(exchanges -> exchanges
			.anyExchange().authenticated()
		)
		.oauth2ResourceServer(oauth2 -> oauth2
			.jwt(jwt -> jwt
				.jwkSetUri("https://idp.example.com/.well-known/jwks.json")
			)
		);
	return http.build();
}






@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        authorizeExchange {
            authorize(anyExchange, authenticated)
        }
        oauth2ResourceServer {
            jwt {
                jwkSetUri = "https://idp.example.com/.well-known/jwks.json"
            }
        }
    }
}






Using jwkSetUri() takes precedence over any configuration property.spring-doc.cadn.net.cn



Using decoder()

decoder() is more powerful than jwkSetUri(), because it completely replaces any Spring Boot auto-configuration of JwtDecoder:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		.authorizeExchange(exchanges -> exchanges
			.anyExchange().authenticated()
		)
		.oauth2ResourceServer(oauth2 -> oauth2
			.jwt(jwt -> jwt
				.decoder(myCustomDecoder())
			)
		);
    return http.build();
}






@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        authorizeExchange {
            authorize(anyExchange, authenticated)
        }
        oauth2ResourceServer {
            jwt {
                jwtDecoder = myCustomDecoder()
            }
        }
    }
}






This is handy when you need deeper configuration, such as validation.spring-doc.cadn.net.cn



Exposing a ReactiveJwtDecoder @Bean

Alternately, exposing a ReactiveJwtDecoder @Bean has the same effect as decoder():
You can construct one with a jwkSetUri like so:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
public ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withJwkSetUri(jwkSetUri).build();
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return NimbusReactiveJwtDecoder.withJwkSetUri(jwkSetUri).build()
}






or you can use the issuer and have NimbusReactiveJwtDecoder look up the jwkSetUri when build() is invoked, like the following:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
public ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withIssuerLocation(issuer).build();
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return NimbusReactiveJwtDecoder.withIssuerLocation(issuer).build()
}






Or, if the defaults work for you, you can also use JwtDecoders, which does the above in addition to configuring the decoder’s validator:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
public ReactiveJwtDecoder jwtDecoder() {
    return ReactiveJwtDecoders.fromIssuerLocation(issuer);
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return ReactiveJwtDecoders.fromIssuerLocation(issuer)
}



Configuring Trusted Algorithms


By default, NimbusReactiveJwtDecoder, and hence Resource Server, trust and verify only tokens that use RS256.spring-doc.cadn.net.cn


You can customize this behavior with Spring Boot or by using the NimbusJwtDecoder builder.spring-doc.cadn.net.cn


Customizing Trusted Algorithms with Spring Boot

The simplest way to set the algorithm is as a property:spring-doc.cadn.net.cn



spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jws-algorithms: RS512
          jwk-set-uri: https://idp.example.org/.well-known/jwks.json




Customizing Trusted Algorithms by Using a Builder

For greater power, though, we can use a builder that ships with NimbusReactiveJwtDecoder:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withIssuerLocation(this.issuer)
            .jwsAlgorithm(RS512).build();
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return NimbusReactiveJwtDecoder.withIssuerLocation(this.issuer)
            .jwsAlgorithm(RS512).build()
}






Calling jwsAlgorithm more than once configures NimbusReactiveJwtDecoder to trust more than one algorithm:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withIssuerLocation(this.issuer)
            .jwsAlgorithm(RS512).jwsAlgorithm(ES512).build();
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return NimbusReactiveJwtDecoder.withIssuerLocation(this.issuer)
            .jwsAlgorithm(RS512).jwsAlgorithm(ES512).build()
}






Alternately, you can call jwsAlgorithms:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withIssuerLocation(this.jwkSetUri)
            .jwsAlgorithms(algorithms -> {
                    algorithms.add(RS512);
                    algorithms.add(ES512);
            }).build();
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return NimbusReactiveJwtDecoder.withIssuerLocation(this.jwkSetUri)
            .jwsAlgorithms {
                it.add(RS512)
                it.add(ES512)
            }
            .build()
}







Trusting a Single Asymmetric Key

Simpler than backing a Resource Server with a JWK Set endpoint is to hard-code an RSA public key.
The public key can be provided with Spring Boot or by Using a Builder.spring-doc.cadn.net.cn


Via Spring Boot

You can specify a key with Spring Boot:spring-doc.cadn.net.cn



spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          public-key-location: classpath:my-key.pub



Alternately, to allow for a more sophisticated lookup, you can post-process the RsaKeyConversionServicePostProcessor:spring-doc.cadn.net.cn


BeanFactoryPostProcessor




Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
BeanFactoryPostProcessor conversionServiceCustomizer() {
    return beanFactory ->
        beanFactory.getBean(RsaKeyConversionServicePostProcessor.class)
                .setResourceLoader(new CustomResourceLoader());
}






@Bean
fun conversionServiceCustomizer(): BeanFactoryPostProcessor {
    return BeanFactoryPostProcessor { beanFactory: ConfigurableListableBeanFactory ->
        beanFactory.getBean<RsaKeyConversionServicePostProcessor>()
                .setResourceLoader(CustomResourceLoader())
    }
}






Specify your key’s location:spring-doc.cadn.net.cn



key.location: hfds://my-key.pub



Then autowire the value:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Value("${key.location}")
RSAPublicKey key;






@Value("\${key.location}")
val key: RSAPublicKey? = null







Using a Builder

To wire an RSAPublicKey directly, use the appropriate NimbusReactiveJwtDecoder builder:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
public ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withPublicKey(this.key).build();
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return NimbusReactiveJwtDecoder.withPublicKey(key).build()
}








Trusting a Single Symmetric Key

You can also use a single symmetric key.
You can load in your SecretKey and use the appropriate NimbusReactiveJwtDecoder builder:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
public ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withSecretKey(this.key).build();
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    return NimbusReactiveJwtDecoder.withSecretKey(this.key).build()
}







Configuring Authorization

A JWT that is issued from an OAuth 2.0 Authorization Server typically has either a scope or an scp attribute, indicating the scopes (or authorities) it has been granted — for example:spring-doc.cadn.net.cn



{ ..., "scope" : "messages contacts"}



When this is the case, Resource Server tries to coerce these scopes into a list of granted authorities, prefixing each scope with the string, SCOPE_.spring-doc.cadn.net.cn


This means that, to protect an endpoint or method with a scope derived from a JWT, the corresponding expressions should include this prefix:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






import static org.springframework.security.oauth2.core.authorization.OAuth2ReactiveAuthorizationManagers.hasScope;

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		.authorizeExchange(exchanges -> exchanges
			.mvcMatchers("/contacts/**").access(hasScope("contacts"))
			.mvcMatchers("/messages/**").access(hasScope("messages"))
			.anyExchange().authenticated()
		)
		.oauth2ResourceServer(OAuth2ResourceServerSpec::jwt);
    return http.build();
}







import org.springframework.security.oauth2.core.authorization.OAuth2ReactiveAuthorizationManagers.hasScope

@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        authorizeExchange {
            authorize("/contacts/**", hasScope("contacts"))
            authorize("/messages/**", hasScope("messages"))
            authorize(anyExchange, authenticated)
        }
        oauth2ResourceServer {
            jwt { }
        }
    }
}







You can do something similar with method security:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@PreAuthorize("hasAuthority('SCOPE_messages')")
public Flux<Message> getMessages(...) {}






@PreAuthorize("hasAuthority('SCOPE_messages')")
fun getMessages(): Flux<Message> { }






Extracting Authorities Manually

However, there are a number of circumstances where this default is insufficient.
For example, some authorization servers do not use the scope attribute. Instead, they have their own custom attribute.
At other times, the resource server may need to adapt the attribute or a composition of attributes into internalized authorities.spring-doc.cadn.net.cn


To this end, the DSL exposes jwtAuthenticationConverter():spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		.authorizeExchange(exchanges -> exchanges
			.anyExchange().authenticated()
		)
		.oauth2ResourceServer(oauth2 -> oauth2
			.jwt(jwt -> jwt
				.jwtAuthenticationConverter(grantedAuthoritiesExtractor())
			)
		);
	return http.build();
}

Converter<Jwt, Mono<AbstractAuthenticationToken>> grantedAuthoritiesExtractor() {
    JwtAuthenticationConverter jwtAuthenticationConverter =
            new JwtAuthenticationConverter();
    jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter
            (new GrantedAuthoritiesExtractor());
    return new ReactiveJwtAuthenticationConverterAdapter(jwtAuthenticationConverter);
}






@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        authorizeExchange {
            authorize(anyExchange, authenticated)
        }
        oauth2ResourceServer {
            jwt {
                jwtAuthenticationConverter = grantedAuthoritiesExtractor()
            }
        }
    }
}

fun grantedAuthoritiesExtractor(): Converter<Jwt, Mono<AbstractAuthenticationToken>> {
    val jwtAuthenticationConverter = JwtAuthenticationConverter()
    jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(GrantedAuthoritiesExtractor())
    return ReactiveJwtAuthenticationConverterAdapter(jwtAuthenticationConverter)
}






jwtAuthenticationConverter() is responsible for converting a Jwt into an Authentication.
As part of its configuration, we can supply a subsidiary converter to go from Jwt to a Collection of granted authorities.spring-doc.cadn.net.cn


That final converter might be something like the following GrantedAuthoritiesExtractor:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






static class GrantedAuthoritiesExtractor
        implements Converter<Jwt, Collection<GrantedAuthority>> {

    public Collection<GrantedAuthority> convert(Jwt jwt) {
        Collection<?> authorities = (Collection<?>)
                jwt.getClaims().getOrDefault("mycustomclaim", Collections.emptyList());

        return authorities.stream()
                .map(Object::toString)
                .map(SimpleGrantedAuthority::new)
                .collect(Collectors.toList());
    }
}






internal class GrantedAuthoritiesExtractor : Converter<Jwt, Collection<GrantedAuthority>> {
    override fun convert(jwt: Jwt): Collection<GrantedAuthority> {
        val authorities: List<Any> = jwt.claims
                .getOrDefault("mycustomclaim", emptyList<Any>()) as List<Any>
        return authorities
                .map { it.toString() }
                .map { SimpleGrantedAuthority(it) }
    }
}






For more flexibility, the DSL supports entirely replacing the converter with any class that implements Converter<Jwt, Mono<AbstractAuthenticationToken>>:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






static class CustomAuthenticationConverter implements Converter<Jwt, Mono<AbstractAuthenticationToken>> {
    public AbstractAuthenticationToken convert(Jwt jwt) {
        return Mono.just(jwt).map(this::doConversion);
    }
}






internal class CustomAuthenticationConverter : Converter<Jwt, Mono<AbstractAuthenticationToken>> {
    override fun convert(jwt: Jwt): Mono<AbstractAuthenticationToken> {
        return Mono.just(jwt).map(this::doConversion)
    }
}








Configuring Validation

Using minimal Spring Boot configuration, indicating the authorization server’s issuer URI, Resource Server defaults to verifying the iss claim as well as the exp and nbf timestamp claims.spring-doc.cadn.net.cn


In circumstances where you need to customize validation needs, Resource Server ships with two standard validators and also accepts custom OAuth2TokenValidator instances.spring-doc.cadn.net.cn


Customizing Timestamp Validation

JWT instances typically have a window of validity, with the start of the window indicated in the nbf claim and the end indicated in the exp claim.spring-doc.cadn.net.cn


However, every server can experience clock drift, which can cause tokens to appear to be expired to one server but not to another.
This can cause some implementation heartburn, as the number of collaborating servers increases in a distributed system.spring-doc.cadn.net.cn


Resource Server uses JwtTimestampValidator to verify a token’s validity window, and you can configure it with a clockSkew to alleviate the clock drift problem:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
ReactiveJwtDecoder jwtDecoder() {
     NimbusReactiveJwtDecoder jwtDecoder = (NimbusReactiveJwtDecoder)
             ReactiveJwtDecoders.fromIssuerLocation(issuerUri);

     OAuth2TokenValidator<Jwt> withClockSkew = new DelegatingOAuth2TokenValidator<>(
            new JwtTimestampValidator(Duration.ofSeconds(60)),
            new IssuerValidator(issuerUri));

     jwtDecoder.setJwtValidator(withClockSkew);

     return jwtDecoder;
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    val jwtDecoder = ReactiveJwtDecoders.fromIssuerLocation(issuerUri) as NimbusReactiveJwtDecoder
    val withClockSkew: OAuth2TokenValidator<Jwt> = DelegatingOAuth2TokenValidator(
            JwtTimestampValidator(Duration.ofSeconds(60)),
            JwtIssuerValidator(issuerUri))
    jwtDecoder.setJwtValidator(withClockSkew)
    return jwtDecoder
}













By default, Resource Server configures a clock skew of 60 seconds.spring-doc.cadn.net.cn







Configuring a Custom Validator

You can Add a check for the aud claim with the OAuth2TokenValidator API:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






public class AudienceValidator implements OAuth2TokenValidator<Jwt> {
    OAuth2Error error = new OAuth2Error("invalid_token", "The required audience is missing", null);

    public OAuth2TokenValidatorResult validate(Jwt jwt) {
        if (jwt.getAudience().contains("messaging")) {
            return OAuth2TokenValidatorResult.success();
        } else {
            return OAuth2TokenValidatorResult.failure(error);
        }
    }
}






class AudienceValidator : OAuth2TokenValidator<Jwt> {
    var error: OAuth2Error = OAuth2Error("invalid_token", "The required audience is missing", null)
    override fun validate(jwt: Jwt): OAuth2TokenValidatorResult {
        return if (jwt.audience.contains("messaging")) {
            OAuth2TokenValidatorResult.success()
        } else {
            OAuth2TokenValidatorResult.failure(error)
        }
    }
}






Then, to add into a resource server, you can specifying the ReactiveJwtDecoder instance:spring-doc.cadn.net.cn






Javaspring-doc.cadn.net.cn


Kotlinspring-doc.cadn.net.cn






@Bean
ReactiveJwtDecoder jwtDecoder() {
    NimbusReactiveJwtDecoder jwtDecoder = (NimbusReactiveJwtDecoder)
            ReactiveJwtDecoders.fromIssuerLocation(issuerUri);

    OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator();
    OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuerUri);
    OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);

    jwtDecoder.setJwtValidator(withAudience);

    return jwtDecoder;
}






@Bean
fun jwtDecoder(): ReactiveJwtDecoder {
    val jwtDecoder = ReactiveJwtDecoders.fromIssuerLocation(issuerUri) as NimbusReactiveJwtDecoder
    val audienceValidator: OAuth2TokenValidator<Jwt> = AudienceValidator()
    val withIssuer: OAuth2TokenValidator<Jwt> = JwtValidators.createDefaultWithIssuer(issuerUri)
    val withAudience: OAuth2TokenValidator<Jwt> = DelegatingOAuth2TokenValidator(withIssuer, audienceValidator)
    jwtDecoder.setJwtValidator(withAudience)
    return jwtDecoder
}

OAuth 2.0 资源服务器 JWT

JWT 的最小依赖项

JWT 的最低配置

指定 Authorization Server

创业期望

运行时预期

直接指定授权服务器 JWK 集 URI

覆盖或替换引导自动配置

Using `jwkSetUri()`

Using `decoder()`

Exposing a `ReactiveJwtDecoder` `@Bean`

Configuring Trusted Algorithms

Customizing Trusted Algorithms with Spring Boot

Customizing Trusted Algorithms by Using a Builder

Trusting a Single Asymmetric Key

Via Spring Boot

Using a Builder

Trusting a Single Symmetric Key

Configuring Authorization

Extracting Authorities Manually

Configuring Validation

Customizing Timestamp Validation

Configuring a Custom Validator