Extract JwtDecoderFactory from JwtClientAssertionAuthenticationProvider

[jgrandja]

We should extract JwtClientAssertionDecoderFactory from JwtClientAssertionAuthenticationProvider into an outer class to allow for customization.

We also need to introduce JwtClientAssertionAuthenticationProvider.setJwtDecoderFactory(JwtDecoderFactory<RegisteredClient>) so an application can configure a customized JwtClientAssertionDecoderFactory, or alternatively, supply their own implementation of JwtDecoderFactory<RegisteredClient>.

[jgrandja]

With the new JwtClientAssertionDecoderFactory, an application now has the ability to customize the Jwt claims validation.

The following configuration demonstrates how to add a custom OAuth2TokenValidator<Jwt> in addition to the default OAuth2TokenValidator<Jwt>'s:

// Customize JwtClientAssertionDecoderFactory
JwtClientAssertionDecoderFactory jwtDecoderFactory = new JwtClientAssertionDecoderFactory();
Function<RegisteredClient, OAuth2TokenValidator<Jwt>> jwtValidatorFactory = (registeredClient) -> {
	OAuth2TokenValidator<Jwt> defaultJwtValidator =
			JwtClientAssertionDecoderFactory.DEFAULT_JWT_VALIDATOR_FACTORY.apply(registeredClient);
	return new DelegatingOAuth2TokenValidator<>(
			defaultJwtValidator,	// Apply default validators
			new JwtClaimValidator<>("custom-claim", "custom-value"::equals));	// Apply custom validator
};
jwtDecoderFactory.setJwtValidatorFactory(jwtValidatorFactory);

// Configure JwtClientAssertionAuthenticationProvider
JwtClientAssertionAuthenticationProvider jwtClientAssertionAuthenticationProvider =
		new JwtClientAssertionAuthenticationProvider(registeredClientRepository, authorizationService);
jwtClientAssertionAuthenticationProvider.setJwtDecoderFactory(jwtDecoderFactory);

[barneag]

Hey @jgrandja,
where exactly we can configure those customs?
Do we need to add entire new JwtClientAssertionAuthenticationProvider to the existing providers, via OAuth2ClientAuthenticationConfigurer?

[sjohnr]

Hi @barneag! The reference documentation was updated in gh-945 (linked above). Take a look at Customizing Jwt Client Assertion Validation. I would recommend bookmarking the project page to quickly find links to the latest reference documentation.