jwt token & spring oauth2

柔情只为你懂 2022-05-17 04:46 300阅读 0赞

原文链接：[http://www.baeldung.com/spring-security-oauth-jwt][http_www.baeldung.com_spring-security-oauth-jwt]

## **1. Overview** ##

In this tutorial we’ll discuss how to get our Spring Security OAuth2 implementation to make use of JSON Web Tokens.

We’re also continuing to built on top of [the previous article][] in this OAuth series.

## **2. Maven Configuration** ##

First, we need to add *spring-security-jwt* dependency to our *pom.xml*:

**<dependency>** 
     **<groupId>**org.springframework.security **</groupId>** 
     **<artifactId>**spring-security-jwt **</artifactId>** 
**</dependency>**

Note that we need to add *spring-security-jwt* dependency to both Authorization Server and Resource Server.

## **3. Authorization Server** ##

Next, we will configure our Authorization Server to use *JwtTokenStore* – as follows:

@Configuration  
  
@EnableAuthorizationServer  
  
**public** **class** **OAuth2AuthorizationServerConfig** **extends** AuthorizationServerConfigurerAdapter \{   
  
     @Override  
  
     **public** void configure (AuthorizationServerEndpointsConfigurer endpoints ) **throws** Exception \{   
  
        endpoints . tokenStore (tokenStore ())  
  
                  . accessTokenConverter (accessTokenConverter ())  
  
                  . authenticationManager (authenticationManager );  
  
     \}  
  
     @Bean  
     **public** TokenStore tokenStore () \{   
         **return** **new** JwtTokenStore (accessTokenConverter ());  
     \}  
  
     @Bean  
     **public** JwtAccessTokenConverter accessTokenConverter () \{   
        JwtAccessTokenConverter converter = **new** JwtAccessTokenConverter ();  
        converter . setSigningKey ( "123" );  
         **return** converter ;  
     \}  
  
     @Bean  
     @Primary  
     **public** DefaultTokenServices tokenServices () \{   
        DefaultTokenServices defaultTokenServices = **new** DefaultTokenServices ();  
        defaultTokenServices . setTokenStore (tokenStore ());  
        defaultTokenServices . setSupportRefreshToken ( **true** );  
         **return** defaultTokenServices ;  
     \}  
\}

Note that we used a** symmetric key** in our *JwtAccessTokenConverter* to sign our tokens – which means we will need to use the same exact key for the Resources Server as well.

## **4. Resource Server** ##

Now, let’s take a look at our Resource Server configuration – which is very similar to the config of the Authorization Server:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 </td> 
 <td> @Configuration @EnableResourceServer public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter { &nbsp;&nbsp;&nbsp;&nbsp;@Override &nbsp;&nbsp;&nbsp;&nbsp;public void configure(ResourceServerSecurityConfigurer config) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;config.tokenServices(tokenServices()); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Bean &nbsp;&nbsp;&nbsp;&nbsp;public TokenStore tokenStore() { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return new JwtTokenStore(accessTokenConverter()); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Bean &nbsp;&nbsp;&nbsp;&nbsp;public JwtAccessTokenConverter accessTokenConverter() { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;converter.setSigningKey("123"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return converter; &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Bean &nbsp;&nbsp;&nbsp;&nbsp;@Primary &nbsp;&nbsp;&nbsp;&nbsp;public DefaultTokenServices tokenServices() { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DefaultTokenServices defaultTokenServices = new DefaultTokenServices(); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;defaultTokenServices.setTokenStore(tokenStore()); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return defaultTokenServices; &nbsp;&nbsp;&nbsp;&nbsp;} } </td> 
 </tr> 
 </tbody> 
</table>

Keep in mind that we’re defining these two servers as entirely separate and independently deployable. That’s the reason we need to declare some of the same beans again here, in the new configuration.

## **5. Custom Claims in the Token** ##

Let’s now set up some infrastructure to be able to add a few **custom claims in the Access Token**. The standard claims provided by the framework are all well and good, but most of the time we’ll need some extra information in the token to utilize on the client side.

We’ll define a *TokenEnhancer* to customize our Access Token with these additional claims.

In the following example, we will add an extra field “*organization*” to our Access Token – with this *CustomTokenEnhancer*:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 </td> 
 <td> public class CustomTokenEnhancer implements TokenEnhancer { &nbsp;&nbsp;&nbsp;&nbsp;@Override &nbsp;&nbsp;&nbsp;&nbsp;public OAuth2AccessToken enhance( &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;OAuth2AccessToken accessToken, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;OAuth2Authentication authentication) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Map&lt;String, Object&gt; additionalInfo = new HashMap&lt;&gt;(); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;additionalInfo.put("organization", authentication.getName() + randomAlphabetic(4)); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;((DefaultOAuth2AccessToken) accessToken).setAdditionalInformation(additionalInfo); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return accessToken; &nbsp;&nbsp;&nbsp;&nbsp;} } </td> 
 </tr> 
 </tbody> 
</table>

Then, we’ll wire that into our **Authorization Server** configuration – as follows:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 </td> 
 <td> @Override public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception { &nbsp;&nbsp;&nbsp;&nbsp;TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain(); &nbsp;&nbsp;&nbsp;&nbsp;tokenEnhancerChain.setTokenEnhancers( &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Arrays.asList(tokenEnhancer(), accessTokenConverter())); &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;endpoints.tokenStore(tokenStore()) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.tokenEnhancer(tokenEnhancerChain) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.authenticationManager(authenticationManager); } &nbsp; @Bean public TokenEnhancer tokenEnhancer() { &nbsp;&nbsp;&nbsp;&nbsp;return new CustomTokenEnhancer(); } </td> 
 </tr> 
 </tbody> 
</table>

With this new configuration up and running – here’s what a token token payload would look like:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 </td> 
 <td> { &nbsp;&nbsp;&nbsp;&nbsp;"user_name": "john", &nbsp;&nbsp;&nbsp;&nbsp;"scope": [ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"foo", &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"read", &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"write" &nbsp;&nbsp;&nbsp;&nbsp;], &nbsp;&nbsp;&nbsp;&nbsp;"organization": "johnIiCh", &nbsp;&nbsp;&nbsp;&nbsp;"exp": 1458126622, &nbsp;&nbsp;&nbsp;&nbsp;"authorities": [ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"ROLE_USER" &nbsp;&nbsp;&nbsp;&nbsp;], &nbsp;&nbsp;&nbsp;&nbsp;"jti": "e0ad1ef3-a8a5-4eef-998d-00b26bc2c53f", &nbsp;&nbsp;&nbsp;&nbsp;"client_id": "fooClientIdPassword" } </td> 
 </tr> 
 </tbody> 
</table>

### **5.1. Use the Access Token in the JS Client** ###

Finally, we’ll want to make use of the token information over in our AngualrJS client application. We’ll use the [angular-jwt][] library for that.

So what we’re going to do is we’re going to make use of the “*organization*” claim in our *index.html*:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 </td> 
 <td> &lt;p class="navbar-text navbar-right"&gt;{ {organization}}&lt;/p&gt; &nbsp; &lt;script type="text/javascript" &nbsp;&nbsp;src="<a href="https://cdn.rawgit.com/auth0/angular-jwt/master/dist/angular-jwt.js" rel="nofollow">https://cdn.rawgit.com/auth0/angular-jwt/master/dist/angular-jwt.js</a>"&gt; &lt;/script&gt; &nbsp; &lt;script&gt; var app = angular.module('myApp', ["ngResource","ngRoute", "ngCookies", "angular-jwt"]); &nbsp; app.controller('mainCtrl', function($scope, $cookies, jwtHelper,...) { &nbsp;&nbsp;&nbsp;&nbsp;$scope.organiztion = ""; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;function getOrganization(){ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var token = $cookies.get("access_token"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var payload = jwtHelper.decodeToken(token); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$scope.organization = payload.organization; &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;... }); </td> 
 </tr> 
 </tbody> 
</table>

## **6. Access Extra Claims on Resource Server** ##

But, how can we access that information over on the resource server side?

What we’ll do here is – extract the extra claims from the access token:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 </td> 
 <td> public Map&lt;String, Object&gt; getExtraInfo(OAuth2Authentication auth) { &nbsp;&nbsp;&nbsp;&nbsp;OAuth2AuthenticationDetails details &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= (OAuth2AuthenticationDetails) auth.getDetails(); &nbsp;&nbsp;&nbsp;&nbsp;OAuth2AccessToken accessToken = tokenStore &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.readAccessToken(details.getTokenValue()); &nbsp;&nbsp;&nbsp;&nbsp;return accessToken.getAdditionalInformation(); } </td> 
 </tr> 
 </tbody> 
</table>

In the following section, we’ll discuss how to add that extra information to our *Authentication* details by using a custom *AccessTokenConverter*

### **6.1. Custom *AccessTokenConverter*** ###

Let’s create *CustomAccessTokenConverter* and set Authentication details with access token claims:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 </td> 
 <td> @Component public class CustomAccessTokenConverter extends DefaultAccessTokenConverter { &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Override &nbsp;&nbsp;&nbsp;&nbsp;public OAuth2Authentication extractAuthentication(Map&lt;String, ?&gt; claims) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;OAuth2Authentication authentication &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= super.extractAuthentication(claims); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;authentication.setDetails(claims); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return authentication; &nbsp;&nbsp;&nbsp;&nbsp;} } </td> 
 </tr> 
 </tbody> 
</table>

Note: *DefaultAccessTokenConverter* used to set Authentication details to Null.

### **6.2. Configure *JwtTokenStore*** ###

Next, we’ll configure our *JwtTokenStore* to use our *CustomAccessTokenConverter*:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 </td> 
 <td> @Configuration @EnableResourceServer public class OAuth2ResourceServerConfigJwt &nbsp;extends ResourceServerConfigurerAdapter { &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Autowired &nbsp;&nbsp;&nbsp;&nbsp;private CustomAccessTokenConverter customAccessTokenConverter; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Bean &nbsp;&nbsp;&nbsp;&nbsp;public TokenStore tokenStore() { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return new JwtTokenStore(accessTokenConverter()); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Bean &nbsp;&nbsp;&nbsp;&nbsp;public JwtAccessTokenConverter accessTokenConverter() { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;converter.setAccessTokenConverter(customAccessTokenConverter); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;// ... } </td> 
 </tr> 
 </tbody> 
</table>

### **6.3. Extra Claims available in the Authentication Object** ###

Now that the Authorization Server added some extra claims in the token, we can now access on the Resource Server side, directly in the Authentication object:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 </td> 
 <td> public Map&lt;String, Object&gt; getExtraInfo(Authentication auth) { &nbsp;&nbsp;&nbsp;&nbsp;OAuth2AuthenticationDetails oauthDetails &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= (OAuth2AuthenticationDetails) auth.getDetails(); &nbsp;&nbsp;&nbsp;&nbsp;return (Map&lt;String, Object&gt;) oauthDetails &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.getDecodedDetails(); } </td> 
 </tr> 
 </tbody> 
</table>

### **6.4. Authentication Details Test** ###

Let’s make sure our Authentication object contains that extra information:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 </td> 
 <td> @RunWith(SpringRunner.class) @SpringBootTest( &nbsp;&nbsp;classes = ResourceServerApplication.class, &nbsp;&nbsp;webEnvironment = WebEnvironment.RANDOM_PORT) public class AuthenticationClaimsIntegrationTest { &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Autowired &nbsp;&nbsp;&nbsp;&nbsp;private JwtTokenStore tokenStore; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;@Test &nbsp;&nbsp;&nbsp;&nbsp;public void whenTokenDoesNotContainIssuer_thenSuccess() { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;String tokenValue = obtainAccessToken("fooClientIdPassword", "john", "123"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;OAuth2Authentication auth = tokenStore.readAuthentication(tokenValue); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Map&lt;String, Object&gt; details = (Map&lt;String, Object&gt;) auth.getDetails(); &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;assertTrue(details.containsKey("organization")); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;private String obtainAccessToken( &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;String clientId, String username, String password) { &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Map&lt;String, String&gt; params = new HashMap&lt;&gt;(); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;params.put("grant_type", "password"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;params.put("client_id", clientId); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;params.put("username", username); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;params.put("password", password); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Response response = RestAssured.given() &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.auth().preemptive().basic(clientId, "secret") &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.and().with().params(params).when() &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.post("<a href="http://localhost:8081/spring-security-oauth-server/oauth/token" rel="nofollow">http://localhost:8081/spring-security-oauth-server/oauth/token</a>"); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return response.jsonPath().getString("access_token"); &nbsp;&nbsp;&nbsp;&nbsp;} } </td> 
 </tr> 
 </tbody> 
</table>

Note: we obtained the access token with extra claims from the Authorization Server, then we read the *Authentication* object from it which contains extra information “organization” in the details object.

## **7. Asymmetric KeyPair** ##

In our previous configuration we used symmetric keys to sign our token:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 </td> 
 <td> @Bean public JwtAccessTokenConverter accessTokenConverter() { &nbsp;&nbsp;&nbsp;&nbsp;JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); &nbsp;&nbsp;&nbsp;&nbsp;converter.setSigningKey("123"); &nbsp;&nbsp;&nbsp;&nbsp;return converter; } </td> 
 </tr> 
 </tbody> 
</table>

We can also use asymmetric keys (Public and Private keys) to do the signing process.

### **7.1. Generate JKS Java KeyStore File** ###

Let’s first generate the keys – and more specifically a *.jks* file – using the command line tool *keytool*:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 </td> 
 <td> keytool -genkeypair -alias mytest &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-keyalg RSA &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-keypass mypass &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-keystore mytest.jks &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-storepass mypass </td> 
 </tr> 
 </tbody> 
</table>

The command will generate a file called *mytest.jks* which contains our keys -the Public and Private keys.

Also make sure *keypass* and *storepass* are the same.

### **7.2. Export Public Key** ###

Next, we need to export our Public key from generated JKS, we can use the following command to do so:

<table> 
 <tbody> 
 <tr> 
 <td> 1 </td> 
 <td> keytool -list -rfc --keystore mytest.jks | openssl x509 -inform pem -pubkey </td> 
 </tr> 
 </tbody> 
</table>

A sample response will look like this:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 </td> 
 <td> -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgIK2Wt4x2EtDl41C7vfp OsMquZMyOyteO2RsVeMLF/hXIeYvicKr0SQzVkodHEBCMiGXQDz5prijTq3RHPy2 /5WJBCYq7yHgTLvspMy6sivXN7NdYE7I5pXo/KHk4nz+Fa6P3L8+L90E/3qwf6j3 DKWnAgJFRY8AbSYXt1d5ELiIG1/gEqzC0fZmNhhfrBtxwWXrlpUDT0Kfvf0QVmPR xxCLXT+tEe1seWGEqeOLL5vXRLqmzZcBe1RZ9kQQm43+a9Qn5icSRnDfTAesQ3Cr lAWJKl2kcWU1HwJqw+dZRSZ1X4kEXNMyzPdPBbGmU6MHdhpywI7SKZT7mX4BDnUK eQIDAQAB -----END PUBLIC KEY----- -----BEGIN CERTIFICATE----- MIIDCzCCAfOgAwIBAgIEGtZIUzANBgkqhkiG9w0BAQsFADA2MQswCQYDVQQGEwJ1 czELMAkGA1UECBMCY2ExCzAJBgNVBAcTAmxhMQ0wCwYDVQQDEwR0ZXN0MB4XDTE2 MDMxNTA4MTAzMFoXDTE2MDYxMzA4MTAzMFowNjELMAkGA1UEBhMCdXMxCzAJBgNV BAgTAmNhMQswCQYDVQQHEwJsYTENMAsGA1UEAxMEdGVzdDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAICCtlreMdhLQ5eNQu736TrDKrmTMjsrXjtkbFXj Cxf4VyHmL4nCq9EkM1ZKHRxAQjIhl0A8+aa4o06t0Rz8tv+ViQQmKu8h4Ey77KTM urIr1zezXWBOyOaV6Pyh5OJ8/hWuj9y/Pi/dBP96sH+o9wylpwICRUWPAG0mF7dX eRC4iBtf4BKswtH2ZjYYX6wbccFl65aVA09Cn739EFZj0ccQi10/rRHtbHlhhKnj iy+b10S6ps2XAXtUWfZEEJuN/mvUJ+YnEkZw30wHrENwq5QFiSpdpHFlNR8CasPn WUUmdV+JBFzTMsz3TwWxplOjB3YacsCO0imU+5l+AQ51CnkCAwEAAaMhMB8wHQYD VR0OBBYEFOGefUBGquEX9Ujak34PyRskHk+WMA0GCSqGSIb3DQEBCwUAA4IBAQB3 1eLfNeq45yO1cXNl0C1IQLknP2WXg89AHEbKkUOA1ZKTOizNYJIHW5MYJU/zScu0 yBobhTDe5hDTsATMa9sN5CPOaLJwzpWV/ZC6WyhAWTfljzZC6d2rL3QYrSIRxmsp /J1Vq9WkesQdShnEGy7GgRgJn4A8CKecHSzqyzXulQ7Zah6GoEUD+vjb+BheP4aN hiYY1OuXD+HsdKeQqS+7eM5U7WW6dz2Q8mtFJ5qAxjY75T0pPrHwZMlJUhUZ+Q2V FfweJEaoNB9w9McPe1cAiE+oeejZ0jq0el3/dJsx3rlVqZN+lMhRJJeVHFyeb3XF lLFCUGhA7hxn2xf3x1JW -----END CERTIFICATE----- </td> 
 </tr> 
 </tbody> 
</table>

We take only our Public key and copy it to our **resource server** *src/main/resources/public.txt*:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 </td> 
 <td> -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgIK2Wt4x2EtDl41C7vfp OsMquZMyOyteO2RsVeMLF/hXIeYvicKr0SQzVkodHEBCMiGXQDz5prijTq3RHPy2 /5WJBCYq7yHgTLvspMy6sivXN7NdYE7I5pXo/KHk4nz+Fa6P3L8+L90E/3qwf6j3 DKWnAgJFRY8AbSYXt1d5ELiIG1/gEqzC0fZmNhhfrBtxwWXrlpUDT0Kfvf0QVmPR xxCLXT+tEe1seWGEqeOLL5vXRLqmzZcBe1RZ9kQQm43+a9Qn5icSRnDfTAesQ3Cr lAWJKl2kcWU1HwJqw+dZRSZ1X4kEXNMyzPdPBbGmU6MHdhpywI7SKZT7mX4BDnUK eQIDAQAB -----END PUBLIC KEY----- </td> 
 </tr> 
 </tbody> 
</table>

Alternatively, we can export only the public key by adding the *-noout* argument:

<table> 
 <tbody> 
 <tr> 
 <td> 1 </td> 
 <td> keytool -list -rfc --keystore mytest.jks | openssl x509 -inform pem -pubkey -noout </td> 
 </tr> 
 </tbody> 
</table>

### **7.3. Maven Configuration** ###

Next, we don’t want the JKS file to be picked up by the maven filtering process – so we’ll make sure to exclude it in the *pom.xml*:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 </td> 
 <td> &lt;build&gt; &nbsp;&nbsp;&nbsp;&nbsp;&lt;resources&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;resource&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;directory&gt;src/main/resources&lt;/directory&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;filtering&gt;true&lt;/filtering&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;excludes&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;exclude&gt;*.jks&lt;/exclude&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/excludes&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/resource&gt; &nbsp;&nbsp;&nbsp;&nbsp;&lt;/resources&gt; &lt;/build&gt; </td> 
 </tr> 
 </tbody> 
</table>

If we’re using Spring Boot, we need to make sure that our JKS file is added to application classpath via the Spring Boot Maven Plugin – *addResources*:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 </td> 
 <td> &lt;build&gt; &nbsp;&nbsp;&nbsp;&nbsp;&lt;plugins&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;plugin&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;groupId&gt;org.springframework.boot&lt;/groupId&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;configuration&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;addResources&gt;true&lt;/addResources&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/configuration&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/plugin&gt; &nbsp;&nbsp;&nbsp;&nbsp;&lt;/plugins&gt; &lt;/build&gt; </td> 
 </tr> 
 </tbody> 
</table>

### **7.4. Authorization Server** ###

Now, we will configure *JwtAccessTokenConverter* to use our KeyPair from *mytest.jks* – as follows:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 </td> 
 <td> @Bean public JwtAccessTokenConverter accessTokenConverter() { &nbsp;&nbsp;&nbsp;&nbsp;JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); &nbsp;&nbsp;&nbsp;&nbsp;KeyStoreKeyFactory keyStoreKeyFactory = &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;new KeyStoreKeyFactory(new ClassPathResource("mytest.jks"), "mypass".toCharArray()); &nbsp;&nbsp;&nbsp;&nbsp;converter.setKeyPair(keyStoreKeyFactory.getKeyPair("mytest")); &nbsp;&nbsp;&nbsp;&nbsp;return converter; } </td> 
 </tr> 
 </tbody> 
</table>

### **7.5. Resource Server** ###

Finally, we need to configure our resource server to use Public key – as follows:

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 </td> 
 <td> @Bean public JwtAccessTokenConverter accessTokenConverter() { &nbsp;&nbsp;&nbsp;&nbsp;JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); &nbsp;&nbsp;&nbsp;&nbsp;Resource resource = new ClassPathResource("public.txt"); &nbsp;&nbsp;&nbsp;&nbsp;String publicKey = null; &nbsp;&nbsp;&nbsp;&nbsp;try { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;publicKey = IOUtils.toString(resource.getInputStream()); &nbsp;&nbsp;&nbsp;&nbsp;} catch (final IOException e) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;throw new RuntimeException(e); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;converter.setVerifierKey(publicKey); &nbsp;&nbsp;&nbsp;&nbsp;return converter; } </td> 
 </tr> 
 </tbody> 
</table>

## **8. Conclusion** ##

In this quick article we focused on setting up our Spring Security OAuth2 project to use JSON Web Tokens.

The **full implementation** of this tutorial can be found in [the github project][] – this is an Eclipse based project, so it should be easy to import and run as it is.

[http_www.baeldung.com_spring-security-oauth-jwt]: http://www.baeldung.com/spring-security-oauth-jwt
[the previous article]: http://www.baeldung.com/spring-security-oauth2-refresh-token-angular-js
[angular-jwt]: https://github.com/auth0/angular-jwt
[the github project]: https://github.com/eugenp/spring-security-oauth