Openid Resource Server: Authenticate with Authorization Header about micronaut-security HOT 9 CLOSED

It's not clear to me what you're trying to do

from micronaut-security.

I want to be able to validate Oauth2 Jwt tokens in a stateless manner using the JWK_Set Url for public key validation. Similar to what Spring Security 5 does for Oauth2 resource server.

What I have done now is use a filter to validate all Jwt Bearer tokens in the Authorization header.

At the moment Micronaut Security Oauth2/OIDC support is stateful using a cookie mechanism.

from micronaut-security.

@juliuskrah That is already being done. The token returned by OpenID providers is validated against their key set URL. The only thing that is stateful is the storage of state/nonce so that it can be validated after the redirect.

from micronaut-security.

I’m aware of this. In a Microservice architecture only one service, usually the UI will handle the Login (Authorization Code Flow), other services will deal with just the Bearer Tokens.
These tokens must be validated.

Micronaut puts these tokens in the cookie which I cannot validate in the Authorization flow.

In my case one Micronaut service works with Auth Code flow with tokens created by Micronaut stored cokies. This service communicates with another Micronaut app by sending the original Jwt from the Identity Provider in the header.
The second service (resource server) must validate the Jwt against the identity provider (no need for another login via Auth flow). This is the portion that’s missing, the verification with the public key.

I hope this clarifies stuff

from micronaut-security.

Micronaut puts these tokens in the cookie which I cannot validate in the Authorization flow.

That is only the case if you have configured it to do so. That is not the default. You can enable the keys controller in the authorization service and have the other services use that

https://micronaut-projects.github.io/micronaut-security/1.2.x/guide/#keys

https://micronaut-projects.github.io/micronaut-security/1.2.x/guide/#jwks

from micronaut-security.

I will look at this and revert

from micronaut-security.

@jameskleeh this works. I used

micronaut:
  security:
    enabled: true
    token:
      jwt:
        enabled: true
        signatures:
          jwks:
            keycloak:
              url: 'https://<domain>:<port>/auth/realms/<realm>/protocol/openid-connect/certs'

I wasn't interested in the keys endpoint.

Question: Any suggestion on how to customize the getName() to use preferred_username instead of Subject?

Question: Also any suggestion on how to extract the roles or scopes to participate in the @Secured({"ROLE_ADMIN", "ROLE_X"}) flow

from micronaut-security.

from micronaut-security.

Copy that

from micronaut-security.