Spring Security 5 - how to use symmetric signingKey?

Viewed 112

I have micro-services running using old Spring Authorization Server and Resource Server (org.springframework.cloud:spring-cloud-starter-oauth2 deprecated now).

For new micro-service I am creating, I need to use newer version of Spring Security 5 implementation of Resource Server. (org.springframework.boot:spring-boot-starter-oauth2-resource-server)

Below is code from my authorization server.

@Configuration
public class AuthorizationServerConfig implements AuthorizationServerConfigurer {

  private final PasswordEncoder passwordEncoder;
  private final DataSource dataSource;
  private final AuthenticationManager authenticationManager;
  private final UserDetailsService userDetailsService;
  private final CustomAccessTokenConverter customAccessTokenConverter;

  @Value("${signing-key:123}")
  private String signingKey;

  public AuthorizationServerConfig(
      PasswordEncoder passwordEncoder,
      DataSource dataSource,
      AuthenticationManager authenticationManager,
      UserDetailsService userDetailsService,
      CustomAccessTokenConverter customAccessTokenConverter) {
    this.passwordEncoder = passwordEncoder;
    this.dataSource = dataSource;
    this.authenticationManager = authenticationManager;
    this.userDetailsService = userDetailsService;
    this.customAccessTokenConverter = customAccessTokenConverter;
  }

  @Bean
  public JwtAccessTokenConverter accessTokenConverter() {
    final JwtAccessTokenConverter jwtAccessTokenConverter = new JwtAccessTokenConverter();
    jwtAccessTokenConverter.setAccessTokenConverter(customAccessTokenConverter);
    jwtAccessTokenConverter.setSigningKey(signingKey);
    return jwtAccessTokenConverter;
  }

  @Bean
  public TokenStore tokenStore() {
    return new JwtTokenStore(accessTokenConverter());
  }

  @Bean
  public ApprovalStore approvalStore() {
    return new JdbcApprovalStore(dataSource);
  }

  @Bean
  public AuthorizationCodeServices authorizationCodeServices() {
    return new JdbcAuthorizationCodeServices(dataSource);
  }

  @Bean
  @Primary
  public DefaultTokenServices tokenServices() {
    final DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
    defaultTokenServices.setTokenStore(tokenStore());
    defaultTokenServices.setSupportRefreshToken(true);
    return defaultTokenServices;
  }

  @Bean
  public TokenEnhancer tokenEnhancer() {
    return new CustomTokenEnhancer();
  }

  @Override
  public void configure(AuthorizationServerSecurityConfigurer security) throws Exception {
    security.checkTokenAccess("isAuthenticated()").tokenKeyAccess("permitAll()");
  }

  @Override
  public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
    clients.jdbc(dataSource).passwordEncoder(passwordEncoder);
  }

  @Override
  public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
    TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain();
    tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(), accessTokenConverter()));
    endpoints.tokenStore(tokenStore());
    endpoints.approvalStore(approvalStore());
    endpoints.authorizationCodeServices(authorizationCodeServices());
    endpoints.authenticationManager(authenticationManager);
    endpoints.tokenEnhancer(tokenEnhancerChain);
    endpoints.userDetailsService(userDetailsService);
  }
}

How do I use the symmetric signing key to decrypt JWT in Spring Security 5?

From migration guide, https://github.com/spring-projects/spring-security/wiki/OAuth-2.0-Migration-Guide I have option to use JWT+JWK or JWT+Key but not sure what to use as my signing key is just a string.

0 Answers
Related