Package org.springframework.security.oauth2.client

Class JwtBearerOAuth2AuthorizedClientProvider

java.lang.Object
org.springframework.security.oauth2.client.JwtBearerOAuth2AuthorizedClientProvider
All Implemented Interfaces:
OAuth2AuthorizedClientProvider
public final class JwtBearerOAuth2AuthorizedClientProvider extends Object implements OAuth2AuthorizedClientProvider
An implementation of an OAuth2AuthorizedClientProvider for the jwt-bearer grant.
Since:
5.5
See Also:

  • Constructor Details

    • JwtBearerOAuth2AuthorizedClientProvider

      public JwtBearerOAuth2AuthorizedClientProvider()

  • Method Details

    • authorize

      @Nullable public OAuth2AuthorizedClient authorize(OAuth2AuthorizationContext context)
      Attempt to authorize (or re-authorize) the client in the provided context. Returns null if authorization (or re-authorization) is not supported, e.g. the client's authorization grant type is not jwt-bearer OR the access token is not expired.
      Specified by:
      authorize in interface OAuth2AuthorizedClientProvider
      Parameters:
      context - the context that holds authorization-specific state for the client
      Returns:
      the OAuth2AuthorizedClient or null if authorization is not supported

    • setAccessTokenResponseClient

      public void setAccessTokenResponseClient(OAuth2AccessTokenResponseClient<JwtBearerGrantRequest> accessTokenResponseClient)
      Sets the client used when requesting an access token credential at the Token Endpoint for the jwt-bearer grant.
      Parameters:
      accessTokenResponseClient - the client used when requesting an access token credential at the Token Endpoint for the jwt-bearer grant

    • setJwtAssertionResolver

      public void setJwtAssertionResolver(Function<OAuth2AuthorizationContext,Jwt> jwtAssertionResolver)
      Sets the resolver used for resolving the Jwt assertion.
      Parameters:
      jwtAssertionResolver - the resolver used for resolving the Jwt assertion
      Since:
      5.7

    • setClockSkew

      public void setClockSkew(Duration clockSkew)
      Sets the maximum acceptable clock skew, which is used when checking the access token expiry. The default is 60 seconds.

      An access token is considered expired if OAuth2AccessToken#getExpiresAt() - clockSkew is before the current time clock#instant().

      Parameters:
      clockSkew - the maximum acceptable clock skew

    • setClock

      public void setClock(Clock clock)
      Sets the Clock used in Instant.now(Clock) when checking the access token expiry.
      Parameters:
      clock - the clock