Spring as a resource server
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
make the Shop API trust an external authorization server.
Planned topics
- Add the OAuth2 resource server starter.
- Set
spring.security.oauth2.resourceserver.jwt.issuer-uri; Spring discovers the keys from the issuer. - Spring validates signature, issuer, and expiry; add an audience check as extra validation.
- Map token claims (such as Keycloak realm roles) to Spring authorities with a
JwtAuthenticationConverter. - The API never handles passwords.
Draft outline details
Demonstration
spring:
security:
oauth2:
resourceserver:
jwt:
issuer-uri: http://localhost:8081/realms/shopCheck your understanding
Where does Spring get the public keys from?
Show answer
From the issuer's discovery and JWKS endpoints.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.