Gh 6053 support jwt bearer grant type

[H-LREB]

This PR is related to gh-6053.

I have been using the classes from Joe Grandja POC for a while and they are working fine. This PR aims at integrating those classes into Spring Security :

• Bring classes from POC
• Change method hasTokenExpired in JwtBearerOAuth2AuthorizedClientProvider to avoid error when including skew time (same as gh-7511)
• Rename classes to follow conventions
• Define and use constants in AuthorizationGrantType, OAuth2ParameterNames and OAuth2AuthorizationContext
• Add jwtBearer builder in OAuth2AuthorizedClientProviderBuilder
• Add Junit tests, mainly copied and adapted from Password grant

[pivotal-issuemaster]

@H-LREB Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-issuemaster]

@H-LREB Thank you for signing the Contributor License Agreement!

[jgrandja]

Thank you @H-LREB ! Please see comment.

[jgrandja]

@H-LREB I just submitted gh-9535 which includes the changes in this PR and adds a polish commit. I ended up removing some of the code so please let me know if you have any questions. I'm going to have @rwinch review gh-9535 and then we will merge before RC1.

I'm going to close this PR.

[H-LREB]

Thank you @jgrandja. That is a great news. I am so happy the feature is likely to be part of the next release.

However, could you reconsider the choice of not allowing the reuse of the obtained access token in class JwtBearerOAuth2AuthorizedClientProvider?

I think the reason behind this choice is mainly the phrase "a reasonably short lifetime" in the spec. However, this does not necessarily imply that the access token cannot be reused. Besides, a "reasonably short" time is relative to the application context (could be a few minutes, several minutes, 1h et.c).

Thus, I think the Spring Framework still can allow reusing the obtained access token as long as it is valid, and let the OAuth Server decide about the reasonable validity interval. In high frequency services, even the reuse of the access token for 5 or 10 minutes may spare a lot of requests to the OAuth server.

[jgrandja]

@H-LREB

could you reconsider the choice of not allowing the reuse of the obtained access token in class JwtBearerOAuth2AuthorizedClientProvider?

The JwtBearerOAuth2AuthorizedClientProvider does allow for reuse of the previously exchanged token.

I think the Spring Framework still can allow reusing the obtained access token as long as it is valid, and let the OAuth Server decide about the reasonable validity interval.

Yes, this is how it was implemented.

[jgrandja]

@H-LREB Thanks for the push on getting this merged !

[H-LREB]

@jgrandja Thank you for these answers. Indeed, I have not read the code carefully enough before submitting my previous comment.

I have another question though. I posted it in 9535 discussion.