Why JwtAccessTokenConverter - Unable to create an RSA verifier from verifierKey (ignoreable if using MAC) when start up a microservice server? - spring

Question

Description:
When the Bet microservice server starts, it never manages to create an RSA verifier because its value is null. I'm developing a microservices-based architecture using Oauth2, taking as a guide the microservices architecture developed by Jhipster:
UAA server. It expose public key to verify JWT signature.
Eureka server.
Cloud Config Server.
Bet microservice server. On start up try to retrieve the public key
to verify signed JWT.
Euraka configuration for each server:
Eureka server:
eureka:
client:
fetch-registry: false
register-with-eureka: false
instance-info-replication-interval-seconds: 10
registry-fetch-interval-seconds: 10
service-url:
defaultZone: http://admin:${spring.security.user.password:admin}#${eureka.instance.hostname}:${server.port}/eureka/
instance:
hostname: localhost
lease-renewal-interval-in-seconds: 5
lease-expiration-duration-in-seconds: 10
UAA server:
eureka:
client:
service-url:
defaultZone: http://admin:eureka#localhost:8761/eureka/
instance-info-replication-interval-seconds: 10
registry-fetch-interval-seconds: 10
instance:
appname: uaa
instanceId: uaa:${spring.application.instance-id:${random.value}}
lease-renewal-interval-in-seconds: 5
lease-expiration-duration-in-seconds: 10
Microservice Bet:
eureka:
client:
service-url:
defaultZone: http://admin:eureka#localhost:8761/eureka/
instance-info-replication-interval-seconds: 10
registry-fetch-interval-seconds: 10
instance:
appname: bets
instanceId: bets:${spring.application.instance-id:${random.value}}
lease-renewal-interval-in-seconds: 5
lease-expiration-duration-in-seconds: 10
When trying to consume a service published by Bet microservice: http://localhost:8083/api/markets, it returns the following response:
{
"error": "invalid_token",
"error_description": "public key expired"
}
status: 401 Unauthorize
Tracing the code I discovered that in class org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter the attribute this.verifier is null inside the afterPropertiesSet () method throwing an Exception (logger.warn ("Unable to create an RSA verifier from verifierKey (ignoreable if using MAC) "))
because I couldn't start the new RsaVerifier object (this.verifierKey)
I thought it was due to the delay time of registering the microservice with the eureka server, so I waited more than 5 min and checked via Postman client that the public key was available and even so the Bet microservice could not create RSA verifier.
So,
Why the Bet microservice at startup failed to create RSA verifier?
Could it be that the public key could not be received when starting
the microservice that is not yet registered with eureka server?

Answer 1

Finally i found the issue.
I must call the tryCreateSignatureVerifier() method when the OAuth2JwtAccessTokenConverter class initialize(in constructor) and to try to retrieve the public key and create RSA verifier
import org.springframework.security.jwt.crypto.sign.SignatureVerifier;
import org.springframework.security.oauth2.common.exceptions.InvalidTokenException;
import org.springframework.security.oauth2.provider.OAuth2Authentication;
import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
public class OAuth2JwtAccessTokenConverter extends JwtAccessTokenConverter {
private final AppProperties properties;
private final OAuth2SignatureVerifierClient signatureVerifierClient;
/**
* When did we last fetch the public key?
*/
private long lastKeyFetchTimestamp;
public OAuth2JwtAccessTokenConverter(OAuth2SignatureVerifierClient signatureVerifierClient, AppProperties properties) {
this.properties = properties;
this.signatureVerifierClient = signatureVerifierClient;
//NOTE, it is very important to try fetch for the public key to verify the JWT signature
tryCreateSignatureVerifier();
}
/**
* Fetch a new public key from the AuthorizationServer.
*
* #return true, if we could fetch it; false, if we could not.
*/
private boolean tryCreateSignatureVerifier() {
long t = System.currentTimeMillis();
if (t - lastKeyFetchTimestamp < properties.getSignatureVerification().getPublicKeyRefreshRateLimit()) {
return false;
}
try {
SignatureVerifier verifier = signatureVerifierClient.getSignatureVerifier();
if (verifier != null) {
setVerifier(verifier);
lastKeyFetchTimestamp = t;
log.debug("Public key retrieved from OAuth2 server to create SignatureVerifier");
return true;
}
} catch (Throwable ex) {
log.error("Could not get public key from OAuth2 server to create SignatureVerifier", ex);
}
return false;
}
/**
* Try to decode the token with the current public key.
* If it fails, contact the OAuth2 server to get a new public key, then try again.
* We might not have fetched it in the first place or it might have changed.
*
* #param token the JWT token to decode.
* #return the resulting claims.
* #throws InvalidTokenException if we cannot decode the token.
*/
#Override
protected Map<String, Object> decode(String token) {
try {
//check if our public key and thus SignatureVerifier have expired
long ltt = properties.getSignatureVerification().getTtl();
if (ltt > 0 && System.currentTimeMillis() - lastKeyFetchTimestamp > ltt) {
throw new InvalidTokenException("public key expired");
}
return super.decode(token);
} catch (InvalidTokenException e) {
if (tryCreateSignatureVerifier()) {
super.decode(token);
}
throw e;
}
}
/**
* Extract JWT claims and set it to OAuth2Authentication decoded details.
* Here is how to get details:
* #param claims OAuth2JWTToken claims.
* #return {#link OAuth2Authentication}.
*/
#Override
public OAuth2Authentication extractAuthentication(Map<String, ?> claims) {
OAuth2Authentication authentication = super.extractAuthentication(claims);
authentication.setDetails(claims);
return authentication;
}
Abstracts how to create a SignatureVerifier to verify JWT tokens with a public key
import org.springframework.security.jwt.crypto.sign.SignatureVerifier;
/**
* Abstracts how to create a {#link SignatureVerifier} to verify JWT tokens with a public key.
* Implementations will have to contact the OAuth2 authorization server to fetch the public key
* and use it to build a {#link SignatureVerifier} in a server specific way.
*
* #see com.example.bets.config.oauth2.OAuth2UaaSignatureVerifierClient
*/
public interface OAuth2SignatureVerifierClient {
/**
* Returns the {#link SignatureVerifier} used to verify JWT tokens.
* Fetches the public key from the Authorization server to create
* this verifier.
*
* #return the new verifier used to verify JWT signatures.
* Will be null if we cannot contact the token endpoint.
* #throws Exception if we could not create a {#link SignatureVerifier} or contact the token endpoint.
*/
SignatureVerifier getSignatureVerifier() throws Exception;
}
Implementation of OAuth2SignatureVerifierClient
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.cloud.client.discovery.DiscoveryClient;
import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.security.jwt.crypto.sign.RsaVerifier;
import org.springframework.security.jwt.crypto.sign.SignatureVerifier;
import org.springframework.security.oauth2.common.exceptions.InvalidClientException;
import org.springframework.stereotype.Component;
import org.springframework.web.client.RestTemplate;
import java.util.Map;
/**
* Client fetching the public key from UAA to create a {#link SignatureVerifier}.
*/
#Slf4j
#Component
public class OAuth2UaaSignatureVerifierClient implements OAuth2SignatureVerifierClient {
private final AppProperties properties;
private final RestTemplate restTemplate;
public OAuth2UaaSignatureVerifierClient(DiscoveryClient discoveryClient,
AppProperties properties,
#Qualifier("loadBalancedRestTemplate") RestTemplate restTemplate) {
this.properties = properties;
this.restTemplate = restTemplate;
// Load available UAA servers
discoveryClient.getServices();
}
/**
* Fetches the public key from the UAA.
*
* #return the public key used to verify JWT tokens; or {#code null}.
*/
#Override
public SignatureVerifier getSignatureVerifier() {
try {
HttpEntity<Void> request = new HttpEntity<Void>(new HttpHeaders());
String key = (String) restTemplate
.exchange(getPublicKeyEndpoint(), HttpMethod.GET,request, Map.class)
.getBody()
.get("value");
return new RsaVerifier(key);
} catch (IllegalStateException ex) {
log.warn("could not contact UAA to get public key");
return null;
}
}
/**
* Returns the configured endpoint URI to retrieve the public key.
*
* #return the configured endpoint URI to retrieve the public key.
*/
private String getPublicKeyEndpoint() {
String tokenEndpointUrl = properties.getSignatureVerification().getPublicKeyEndpointUri();
if (tokenEndpointUrl == null) {
throw new InvalidClientException("no token endpoint configured in application properties");
}
return tokenEndpointUrl;
}
}
Finally Class SecurityConfiguration extends ResourceServerConfigurerAdapter
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
import org.springframework.security.oauth2.provider.token.TokenStore;
import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenConverter;
import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
#Configuration
#EnableResourceServer
#EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfiguration extends ResourceServerConfigurerAdapter {
private final AppProperties properties;
public SecurityConfiguration(AppProperties properties) {
this.properties = properties;
}
#Override
public void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.headers().frameOptions().disable()
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/api/**").authenticated()
.antMatchers("/management/health").permitAll()
.antMatchers("/management/info").permitAll()
.antMatchers("/management/prometheus").permitAll()
.antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN);
}
/**
* Apply the token converter (and enhancer) for token store.
*
* #return the {#link JwtTokenStore} managing the tokens.
*/
#Bean
public TokenStore tokenStore(JwtAccessTokenConverter jwtAccessTokenConverter){
return new JwtTokenStore(jwtAccessTokenConverter);
}
/**
* This bean generates an token enhancer, which manages the exchange between JWT access tokens and Authentication
* in both directions.
*
* #return an access token converter configured with the fetched public key of the authorization server.
*/
#Bean
public JwtAccessTokenConverter jwtAccessTokenConverter(OAuth2SignatureVerifierClient signatureVerifierClient) {
return new OAuth2JwtAccessTokenConverter(properties, signatureVerifierClient);
}
}
Maven Dependecies
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.2.6.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<properties>
<java.version>1.8</java.version>
<spring-cloud.version>Hoxton.SR4</spring-cloud.version>
</properties>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>${spring-cloud.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>