Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CfSingleSignOnProcessor should set jwk-set-uri #85

Open
xyloman opened this issue Feb 6, 2020 · 2 comments
Open

CfSingleSignOnProcessor should set jwk-set-uri #85

xyloman opened this issue Feb 6, 2020 · 2 comments

Comments

@xyloman
Copy link
Contributor

xyloman commented Feb 6, 2020

In order for spring boot resource servers to automatically build a JwtDecoder, the property spring.security.oauth2.resourceserver.jwt.jwk-set-uri should be set CfSingleSignOnProcessor so that OAuth2ResourceServerJwtConfiguration.java builds the JwtDecoder bean.

@xyloman
Copy link
Contributor Author

xyloman commented Feb 6, 2020

Otherwise with out this configuration an application has to set the jwk-set-uri property themselves with the information that comes from the service binding:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          jwk-set-uri: ${identity.auth_domain}/token_keys
          jwk-set-uri: ${vcap.services.identity.credentials.auth_domain}/token_keys

@dyroberts
Copy link
Contributor

java-cfenv-boot-pivotal-sso module is presently only supporting spring-security oauth2 client properties.
This request implies supporting resource server as well, which is a good idea.
However, most recent docs suggest setting only the ...resourceserver.jwt.issuer-uri property.
https://docs.spring.io/spring-security/site/docs/5.3.2.RELEASE/reference/html5/#oauth2resourceserver-jwt-minimalconfiguration
I'll have to take a look at this a little further.
I could also consider a contribution if you want to submit a PR @xyloman!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants