Package org.springframework.security.oauth2.server.resource.authentication

Class JwtIssuerReactiveAuthenticationManagerResolver

java.lang.Object

org.springframework.security.oauth2.server.resource.authentication.JwtIssuerReactiveAuthenticationManagerResolver

All Implemented Interfaces:

ReactiveAuthenticationManagerResolver<org.springframework.web.server.ServerWebExchange>

public final class JwtIssuerReactiveAuthenticationManagerResolver
extends Object
implements ReactiveAuthenticationManagerResolver<org.springframework.web.server.ServerWebExchange>

An implementation of ReactiveAuthenticationManagerResolver that resolves a JWT-based ReactiveAuthenticationManager based on the Issuer in a signed JWT (JWS). To use, this class must be able to determine whether the `iss` claim is trusted. Recall that anyone can stand up an authorization server and issue valid tokens to a resource server. The simplest way to achieve this is to supply a set of trusted issuers in the constructor. This class derives the Issuer from the `iss` claim found in the ServerWebExchange's Bearer Token.

Since:

5.3

Constructor Summary

Constructors

Constructor	Description
JwtIssuerReactiveAuthenticationManagerResolver(String... trustedIssuers)	Deprecated, for removal: This API element is subject to removal in a future version. use fromTrustedIssuers(String...)
JwtIssuerReactiveAuthenticationManagerResolver(Collection<String> trustedIssuers)	Deprecated, for removal: This API element is subject to removal in a future version. use fromTrustedIssuers(Collection)
JwtIssuerReactiveAuthenticationManagerResolver(ReactiveAuthenticationManagerResolver<String> issuerAuthenticationManagerResolver)	Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters Note that the ReactiveAuthenticationManagerResolver provided in this constructor will need to verify that the issuer is trusted.

Method Summary

Modifier and Type	Method	Description
static JwtIssuerReactiveAuthenticationManagerResolver	fromTrustedIssuers(String... trustedIssuers)	Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters
static JwtIssuerReactiveAuthenticationManagerResolver	fromTrustedIssuers(Collection<String> trustedIssuers)	Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters
static JwtIssuerReactiveAuthenticationManagerResolver	fromTrustedIssuers(Predicate<String> trustedIssuers)	Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters
reactor.core.publisher.Mono<ReactiveAuthenticationManager>	resolve(org.springframework.web.server.ServerWebExchange exchange)	Return an AuthenticationManager based off of the `iss` claim found in the request's bearer token

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

JwtIssuerReactiveAuthenticationManagerResolver

@Deprecated(since="6.2",
            forRemoval=true)
public JwtIssuerReactiveAuthenticationManagerResolver(String... trustedIssuers)

Deprecated, for removal: This API element is subject to removal in a future version.

use fromTrustedIssuers(String...)

Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters

Parameters:

trustedIssuers - an array of trusted issuers

JwtIssuerReactiveAuthenticationManagerResolver

@Deprecated(since="6.2",
            forRemoval=true)
public JwtIssuerReactiveAuthenticationManagerResolver(Collection<String> trustedIssuers)

Deprecated, for removal: This API element is subject to removal in a future version.

use fromTrustedIssuers(Collection)

Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters

Parameters:

trustedIssuers - a collection of trusted issuers

JwtIssuerReactiveAuthenticationManagerResolver

public JwtIssuerReactiveAuthenticationManagerResolver(ReactiveAuthenticationManagerResolver<String> issuerAuthenticationManagerResolver)

Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters Note that the ReactiveAuthenticationManagerResolver provided in this constructor will need to verify that the issuer is trusted. This should be done via an allowed set of issuers. One way to achieve this is with a Map where the keys are the known issuers:

     Map<String, ReactiveAuthenticationManager> authenticationManagers = new HashMap<>();
     authenticationManagers.put("https://issuerOne.example.org", managerOne);
     authenticationManagers.put("https://issuerTwo.example.org", managerTwo);
     JwtIssuerReactiveAuthenticationManagerResolver resolver = new JwtIssuerReactiveAuthenticationManagerResolver
        ((issuer) -> Mono.justOrEmpty(authenticationManagers.get(issuer));
 

The keys in the Map are the trusted issuers.

Parameters:

issuerAuthenticationManagerResolver - a strategy for resolving the ReactiveAuthenticationManager by the issuer

Method Details

fromTrustedIssuers

public static JwtIssuerReactiveAuthenticationManagerResolver fromTrustedIssuers(String... trustedIssuers)

Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters

Parameters:

trustedIssuers - an array of trusted issuers

Since:

6.2

fromTrustedIssuers

public static JwtIssuerReactiveAuthenticationManagerResolver fromTrustedIssuers(Collection<String> trustedIssuers)

Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters

Parameters:

trustedIssuers - a collection of trusted issuers

Since:

6.2

fromTrustedIssuers

public static JwtIssuerReactiveAuthenticationManagerResolver fromTrustedIssuers(Predicate<String> trustedIssuers)

Construct a JwtIssuerReactiveAuthenticationManagerResolver using the provided parameters

Parameters:

trustedIssuers - a predicate to validate issuers

Since:

6.2

resolve

public reactor.core.publisher.Mono<ReactiveAuthenticationManager> resolve(org.springframework.web.server.ServerWebExchange exchange)

Return an AuthenticationManager based off of the `iss` claim found in the request's bearer token

Specified by:

resolve in interface ReactiveAuthenticationManagerResolver<org.springframework.web.server.ServerWebExchange>

Throws:

OAuth2AuthenticationException - if the bearer token is malformed or an ReactiveAuthenticationManager can't be derived from the issuer