Spring Boot Resource server fails to authenticate my token - spring

Question

I am a beginner in Spring outh2 security. I was trying to secure my spring boot rest api's and run them in postman ,
But I always get the "Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Invalid signature", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"" error.
Note:- I am using Azure AD as an authorization server.
Steps followed .
Implemented the below code in STS and ran the application.
Created a access token using the postman "Get New Access Token" using Client Credentials Auth type.
Use that access token and call my spring boot api using Get request.
Note: - When I copy my postman generated token in jwt.io I get a Invalid Signature at the bottom ..but I am able to read the header /payload.
But when I switch the algorithm to HS256 , I don't get an Invalid signature any more.
screenshot of postman
Below is my basic code.
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.0.0</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.example</groupId>
<artifactId>resourceserver</artifactId>
<version>0.0.1-SNAPSHOT</version>
<packaging>war</packaging>
<name>resourceserver</name>
<description>Demo project for Spring Boot</description>
<properties>
<java.version>17</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-oauth2-jose</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-tomcat</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
My application.properties
server.port=8090
logging.level.org.springframework.security=DEBUG
spring.security.oauth2.resourceserver.jwt.issuer-uri=https://sts.windows.net/tenenentid
Tried using this url as well , but no luck.
spring.security.oauth2.resourceserver.jwt.issuer-uri=https://login.microsoftonline.com/tenentid
Basic Rest api.
#GetMapping("/validateApi")
public String validateApi() {
System.out.println("validateApi");
return "invalid";
}
Not sure if I am missing on any other additional steps. I have not customized any security config as such. So I am assuming it just uses the default configs.
Any help will be appreciated .
Thanks!!

Answer 1

I tried to reproduce the same in my environment and got the results like below:
I generated the access token using below parameters:
https://login.microsoftonline.com/TenantID/oauth2/v2.0/token
client_id:ClientID
client_secret:ClientSecret
scope:https://graph.microsoft.com/.default
grant_type:client_credentials
When I decoded the token, I got the same error as below:
Note that: The token generated for Graph doesn't require validation and it will not verify signature in the code.
Alternatively, to resolve the error you can Expose an API in the Portal like below:
I generated the access token with the scope as api://ClientIDofApp/.default :
The signature got verified successfully like below: