How configure the JwtAuthenticationConverter for a specific claim structure? - spring-boot

Question

I have a JWT where the roles can be found under a specific claim. This claim is in a nested structure.
How can I tell the JwtAuthenticationConverter to find the roles under a certain path ?
As Authorization-Server I use Keycloak. It would be a possibility to add a mapper for the roles. But I want to exclude this possibility for now, because the goal is to find the roles under the specific claim.
Here is my decoded JWT. The role "user-role" should be located under the claim: "resource_access" -> "user" -> "roles":
"resource_access": {
"admin": {
"roles": [
"admin-role"
]
},
"user": {
"roles": [
"user-role"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
And here is my configuration for the JwtAuthenticationConverter:
#EnableWebSecurity
#EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
#Override
public void configure(HttpSecurity http) throws Exception
{
http.authorizeRequests()
.anyRequest()
.authenticated()
.and()
.oauth2ResourceServer()
.jwt()
.jwtAuthenticationConverter(jwtAuthenticationConverter());
}
private static JwtAuthenticationConverter jwtAuthenticationConverter()
{
var jwtGrantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
jwtGrantedAuthoritiesConverter.setAuthoritiesClaimName("resource_access.user.roles");
jwtGrantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
var jwtAuthenticationConverter = new JwtAuthenticationConverter();
jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(jwtGrantedAuthoritiesConverter);
return jwtAuthenticationConverter;
}
}
I hope someone can help me. Thanks :)

Answer 1

thanks for your help. The solution was to implement a custom converter.
Here is my solution:
My custom converter:
#AllArgsConstructor
public class KeycloakJwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken>
{
#NotEmpty
private List<String> clientIds;
#Override
public AbstractAuthenticationToken convert(Jwt source)
{
return new JwtAuthenticationToken(source, Stream.concat(new JwtGrantedAuthoritiesConverter().convert(source)
.stream(), extractResourceRoles(source).stream())
.collect(toSet()));
}
private Collection<? extends GrantedAuthority> extractResourceRoles(Jwt jwt)
{
var resourceAccess = new HashMap<>(jwt.getClaim("resource_access"));
var resourceRoles = new ArrayList<>();
clientIds.stream().forEach(id ->
{
if (resourceAccess.containsKey(id))
{
var resource = (Map<String, List<String>>) resourceAccess.get(id);
resource.get("roles").forEach(role -> resourceRoles.add(id + "_" + role));
}
});
return resourceRoles.isEmpty() ? emptySet() : resourceRoles.stream().map(r -> new SimpleGrantedAuthority("ROLE_" + r)).collect(toSet());
}
}
My security config:
#EnableWebSecurity
#EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
#Value("${spring.security.jwt.role.locations}")
private List<String> rolesLocation;
#Override
public void configure(HttpSecurity http) throws Exception
{
http.authorizeRequests()
.anyRequest()
.authenticated()
.and()
.oauth2ResourceServer()
.jwt()
.jwtAuthenticationConverter(new KeycloakJwtAuthenticationConverter(rolesLocation));
}
}