Expose strategy for converting Jwt into Authentication

[jzheaux]

Let's expose a strategy for converting a Jwt into an Authentication.

The flow from bearer token to Authentication goes something like this:

String token -> Jwt jwt
Jwt jwt -> Authentication authentication

The first step can be configured by wiring JwtAuthenticationProvider with an instance of JwtDecoder.

We could do the same thing with the second step.

Spring Core has a Converter interface that could work well.

Let's include also an abstract implementation that makes it easier to only participate in the conversion of the Jwt into a set of GrantedAuthorities.

[gburboz]

Is this for converting jwt based access token to authentication without having to invoke user-info service?

Suggestion

• it will also be great if default jwt converter can perform conversion based off OIDC Standard Claims and/or provide ability to configure mapping of claims on token to expected claim names.
• need to consider which claim to be used for principal name which should default to claim expression <sub>@<iss>

[jzheaux]

@gburboz The initial target for this strategy is Resource Server, where the story is more about inferring a set of authorities from a bearer token and less about who is the subject. To that end, the converter for the time being only exposes an override for inferring a Collection<GrantedAuthority> from the jwt.

That said, yes, the idea is that broader conversions will be possible as well. At this point, the only place we have concrete plans to expose this strategy is in the Resource Server DSL.

I like your suggestions for some common conversion use cases and have taken note. Would recommend that you open a ticket and ping @jgrandja about it.

[gburboz]

Thanks @jzheaux , I have raised ticket #5659