Support JWT Bearer Client Authentication

[jgrandja]

This feature will deliver Using JWTs for Client Authentication defined in the JSON Web Token (JWT) Profile spec.

[rlewczuk]

I've implemented client authentication part of this specification. If there are no objections, I'm ready to issue PR as soon as 0.1.2 cycle starts.

This implementation contains significant amount of duplicated code (PKCE related) that needs to be factored out, I'm aware of that and plan to take care of it.

Branch implementing this feature is here: https://github.com/rlewczuk/spring-authorization-server/tree/jwt-client-auth

Update: JWT client authentication is also being implemented in spring-security, so this patch needs to rebased to new spring-security and adapted to new codebase

[rlewczuk]

Here is another part of this epic - JWT assertion grant type: https://github.com/rlewczuk/spring-authorization-server/tree/jwt-assertion-grant

In both parts I had to make some design decisions that really need to be reviewed and discussed. Plus I have to review it once again for compliance with RFC (especially error codes). If you have time some time next week, we can start working on this.

Update: JWT authentication grants is also being implemented in spring-security, so this patch needs to rebased to new spring-security and adapted to new codebase

[jgrandja]

Thanks @rlewczuk !

Let's focus on JWT client authentication for 0.1.2. I'm not sure when JWT authorization grant will get scheduled at this point.

I'm pretty backlogged over the next 2 weeks. After 0.1.1 is out, please submit PR for JWT client authentication. Thanks!

[larsw]

What's the status for this feature?

[jgrandja]

@larsw This is scheduled for 0.2.1 as indicated in the Milestone.