JWKS demo

[kevinwallimann]

Closes #62

This is just a draft to demonstrate the JWKS endpoint for the public key. JWKS is a standard defined in https://datatracker.ietf.org/doc/html/rfc7517 and is implemented e.g. by
org.springframework.boot:spring-boot-starter-oauth2-resource-server. Resource servers can just add this dependency instead of implementing fetching and parsing the endpoint themselves. Instead, it's just one line of application configuration, i.e.

spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:9090/token/public-key-jwks

and a few lines in the security configuration (which you need for any JWT security)

Problems

The following issues need to be discussed before merging

• I had to add the Nimbus JOSE JWT library https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/, https://connect2id.com/products/nimbus-jose-jwt, which covers similar functionality as https://github.com/jwtk/jjwt. Unfortunately, jjwt supports JWK only in master, but not in the latest released version v0.11.5

[github-actions]

JaCoCo code coverage report - scala:2.12.17

File	Coverage [92.25%]	🍏
TokenController.scala	100%	🍏
SecurityConfig.scala	100%	🍏
JWTService.scala	84.62%	🍏

Total Project Coverage	75.52%	🍏

[jakipatryk]

Instead, it's just one line of application configuration, i.e.
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:9090/token/public-key-jwks

Does it support JWKS refresh out of the box? If yes, how often does it do that?

[kevinwallimann]

Instead, it's just one line of application configuration, i.e.
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://localhost:9090/token/public-key-jwks

Does it support JWKS refresh out of the box? If yes, how often does it do that?

Excellent question! It is refreshed every 5 mins, see https://bitbucket.org/connect2id/nimbus-jose-jwt/src/9.24.4/src/main/java/com/nimbusds/jose/jwk/source/DefaultJWKSetCache.java

I've just tried it out myself

[dk1844]

I looked it over and I agree that it would be useful to have as an addition.
It is a pity that jjwt do not have it in release right now, based on some of their information and the state of the milestone, it might be "soon".

I don't mind the Nimbus JOSE JWT library that much, considering we are hopefully looking forward to replacing it eventually.
@kevinwallimann, if you feel like finishing this, be my guest; if you don't want to or don't have time, we could do it, I hope.

I have created a small update on @kevinwallimann's work in #64

I have tried it to the point that the new endpoint at /token/public-key-jwks generates the key, but I have not tried to use it further.

[dk1844]

LGTM, checked out, ran tests this time.