Spring-security: Resource Server configurers should pick up a JwtAuthenticationConverter bean

[jzheaux]

It's quite convenient to be able to expose JwtDecoder or ReactiveJwtDecoder as a bean and have Spring Security's OAuth 2.0 Resource Server pick it up.

It would be nice to be able to do the same with JwtAuthenticationConverter:

@Bean 
JwtAuthenticationConverter jwtAuthenticationConverter() {
    JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
    converter.setJwtGrantedAuthoritiesConverter(...);
    return converter;
}

[evgeniycheban]

I would like to take this task.

[akuma8]

@jzheaux Yes this could solve my issue where I have multiple filter chains but as a client I should not have to worry about that bean, I want to define it and forget it. I mean, I don’t want to inject that bean in each filter chain, spring security should handle it behind the scene.

[jzheaux]

Sure, @evgeniycheban! It's yours.

[akuma8]

Hi @jzheaux,
Is this feature released? If yes, which version of Spring Security? I would like to migrate my current configurations to this one.
Also I would like to contribute again, if you have issues for new committers please let me kow.

[jzheaux]

Yes, @akuma8, it was released in 5.4.0-M1. The GA version (5.4.0) released in September.

It would be great to get more contributions from you! Please check for the ideal-for-contribution label for some ideas. Currently, I don't see any OAuth 2.0 ones, but there's a SAML 2.0 ticket there that would be helpful.