Package org.springframework.security.oauth2.server.resource.authentication

Class JwtIssuerReactiveAuthenticationManagerResolver

java.lang.Object
org.springframework.security.oauth2.server.resource.authentication.JwtIssuerReactiveAuthenticationManagerResolver
All Implemented Interfaces:
org.springframework.security.authentication.ReactiveAuthenticationManagerResolver<org.springframework.web.server.ServerWebExchange>
public final class JwtIssuerReactiveAuthenticationManagerResolver extends Object implements org.springframework.security.authentication.ReactiveAuthenticationManagerResolver<org.springframework.web.server.ServerWebExchange>
An implementation of ReactiveAuthenticationManagerResolver that resolves a JWT-based ReactiveAuthenticationManager based on the Issuer in a signed JWT (JWS). To use, this class must be able to determine whether the `iss` claim is trusted. Recall that anyone can stand up an authorization server and issue valid tokens to a resource server. The simplest way to achieve this is to supply a set of trusted issuers in the constructor. This class derives the Issuer from the `iss` claim found in the ServerWebExchange's Bearer Token.
Since:
5.3

  • Constructor Details

    • JwtIssuerReactiveAuthenticationManagerResolver

      @Deprecated(since="6.2", forRemoval=true) public JwtIssuerReactiveAuthenticationManagerResolver(String... trustedIssuers)
      Deprecated, for removal: This API element is subject to removal in a future version.
      use fromTrustedIssuers(String...)
      Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters
      Parameters:
      trustedIssuers - an array of trusted issuers

    • JwtIssuerReactiveAuthenticationManagerResolver

      @Deprecated(since="6.2", forRemoval=true) public JwtIssuerReactiveAuthenticationManagerResolver(Collection<String> trustedIssuers)
      Deprecated, for removal: This API element is subject to removal in a future version.
      use fromTrustedIssuers(Collection)
      Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters
      Parameters:
      trustedIssuers - a collection of trusted issuers

    • JwtIssuerReactiveAuthenticationManagerResolver

      public JwtIssuerReactiveAuthenticationManagerResolver(org.springframework.security.authentication.ReactiveAuthenticationManagerResolver<String> issuerAuthenticationManagerResolver)
      Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters Note that the ReactiveAuthenticationManagerResolver provided in this constructor will need to verify that the issuer is trusted. This should be done via an allowed set of issuers. One way to achieve this is with a Map where the keys are the known issuers: 
           Map<String, ReactiveAuthenticationManager> authenticationManagers = new HashMap<>();
     authenticationManagers.put("https://issuerOne.example.org", managerOne);
     authenticationManagers.put("https://issuerTwo.example.org", managerTwo);
     JwtIssuerReactiveAuthenticationManagerResolver resolver = new JwtIssuerReactiveAuthenticationManagerResolver
        ((issuer) -> Mono.justOrEmpty(authenticationManagers.get(issuer));
      The keys in the Map are the trusted issuers.
      Parameters:
      issuerAuthenticationManagerResolver - a strategy for resolving the ReactiveAuthenticationManager by the issuer

  • Method Details