Auto-configure a JwtAuthenticationConverter

[ykardziyaka]

Adds support for auto-configuring JwtAuthenticationConverter (and ReactiveJwtAuthenticationConverter) with following properties:

• spring.security.oauth2.resourceserver.jwt.authority-prefix
• spring.security.oauth2.resourceserver.jwt.authorities-claim-delimiter
• spring.security.oauth2.resourceserver.jwt.authorities-claim-name
• spring.security.oauth2.resourceserver.jwt.principal-claim-name

Closes gh-33689

[mhalbritter]

When merging, we should let the bean back off if no properties are set. Right now, it always supplies the JWT converter.

[mhalbritter]

I got some amended changes here: https://github.com/mhalbritter/spring-boot/tree/pr/38105

[mhalbritter]

Thanks a lot!

[Jojoooo1]

Are you planning to add nested authorities-claim-name ? For example, Keycloak is nesting the roles in realm_access.roles

[wilkinsona]

@Jojoooo1 I don't think so, but I'm not sure that I understand what you're asking for. Please open a new issue describing how to configure a JwtGrantedAuthoritiesConverter that meets your needs. We can then consider how we could support such configuration using application properties.

[Jojoooo1]

Sorry I was not very clear, I was wondering if in the future you are planning to allow nested claim name with the property spring.security.oauth2.resourceserver.jwt.authorities-claim-name. My use case was regarding Keycloak for example the jwt structure is as follows:

"realm_access": {
    "roles": [
      "default-roles-api",
      "offline_access",
      "uma_authorization",
      "management_user"
    ]
  },
 "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },

[wilkinsona]

spring.security.oauth2.resourceserver.jwt.authorities-claim-name maps onto org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter.setAuthoritiesClaimName(String). If you want that to support more than it currently does today, I believe a change to JwtGrantedAuthoritiesConverter, which is part of Spring Security, would be required. If this is something that you would like to see, please open an issue over there.