Add possibility to customize JwkSource of NimbusJwtDecoder #17046

marbon87 · 2025-05-06T12:23:29Z

We want to increase the cache-ttl of the NimbusJwtDecoder respectively the underlying JWKSource. Furthermore we want to use the refresh-ahead caching of JWKSource.

The com.nimbusds.jose.jwk.source.JWKSourceBuilder provides a lot of features to customize how jwks are cached / update etc. but currently there is no way to customize it.
The implemented possiiblity to customiz the used JWKSourceBuilder in NimbusJwtDecoder allows to use all features from JWKSourceBuilder.

jzheaux · 2025-05-07T22:09:18Z

Thanks for the PR, @marbon87! I'm curious if it would be easier to construct your own JWKSource instance?

If so, this PR instead might add something similar to NimbusReactiveJwtDecoder#withJwkSource.

marbon87 · 2025-05-08T08:58:55Z

Hi @jzheaux, thanks for your feedback!

If i unterstand the current implementation correctly, adding a separate builder-creation method like NimbusReactiveJwtDecoder#withJwkSource would mean that the jwkSetUri must be specified explicitly / constructed manually. I prefer configuring the issuer-uri and let spring query the jwkSetUri by calling the well-known-config endpoint.

Furthermore i cannot use SpringJWKSource because it's private nor can i customize it because it's final.

Overall I have to write a lot more code as a user of spring-security, if i want to increase the timeouts.

jzheaux · 2025-05-09T18:00:47Z

Possibly, though I wonder if it is as much as you are thinking (perhaps it's also more than I'm thinking). SpringJWKSource allows you to use RestOperations and Spring Cache instances. However, you are wanting to use Nimbus's caching. Because of that, I imagine you'll be satisfied with working with JWKSourceBuilder directly.

As for the URI, I think that Nimbus has an API that's quite adept at this:

AuthorizationServerMetadata metadata = AuthorizationServerMetadata
    .resolve(new Issuer("https://example.org/issuer"));
String jwkSetUri = metadata.getJwkSetUri();
// ...

It seems to me that this would result in the following:

@Bean
JwtDecoder jwtDecoder(String issuer) {
    AuthorizationServerMetadata metadata = AuthorizationServerMetadata
        .resolve(new Issuer("https://example.org/issuer"));
    String jwkSetUri = metadata.getJwkSetUri();
    JWKSource<SecurityContext> source = JWKSourceBuilder.create(new URL(jwkSetUri))
        // your caching settings
        .build();
    return NimbusJwtDecoder.withJwkSource(source)
        // your decoding settings
        .build();
}

Alternatively, Spring Cache is also quite adept at timeouts and other caching functions if you are open to working with that instead.

What complexities am I failing to consider?

marbon87 · 2025-05-12T12:26:11Z

Your suggestion should work but i am not sure what's missing to get it "completed".
For example the SpringJWKSource seems to be thread-safe, because of the usage of a ReentrantLock.
Furthermore i thought that there must be a reason why spring does not use your approach as the default and instead implements a custom JWKSetSource.

Regarding to spring cache, i did not find an simple solutation for a refresh or/and fault tolerant ahead cache.

jzheaux · 2025-05-12T22:55:48Z

Gotcha, I can see how the code gives that impression. It uses a custom JWKSetSource to allow applications to use their RestOperations and Cache instances.

If you want to look further into Spring Cache, I think Spring's JCache integration would make sense since you can integrate in this way with Hazelcast and other caches that support refresh-ahead. That said, you know your requirements best and whether the ease of Nimbus's in-memory caching will suit your needs.

Your suggestion should work but i am not sure what's missing to get it "completed".

Am I understanding correctly that you are asking for how the PR would change? To add withJwkSource, you would need to add the appropriate static method to NimbusJwtDecoder; it's implementation would likely be similar to withJwkSource in NimbusReactiveJwtDecoder. Would you like me to push a stub implementation to your branch to get you started?

marbon87 · 2025-05-13T08:47:39Z

Am I understanding correctly that you are asking for how the PR would change? To add withJwkSource, you would need to add the appropriate static method to NimbusJwtDecoder; it's implementation would likely be similar to withJwkSource in NimbusReactiveJwtDecoder. Would you like me to push a stub implementation to your branch to get you started?

Thanks for your offer, but i think i can manage that. Should i close this pr and create a new one referencing this?

jzheaux · 2025-05-13T14:13:23Z

Up to you, @marbon87. Honestly, the title of the PR still seems to work well with what we are talking about now and I'd be fine with reusing it.

marbon87 · 2025-05-16T13:53:35Z

Hi @jzheaux,

i updated the pr. Please have a look.

Signed-off-by: Mark Bonnekessel <[email protected]>

PR spring-projectsgh-17046 Signed-off-by: Mark Bonnekessel <[email protected]>

- Since JWKSource supercedes the usage of RestOperations and Cache, this commit creates a new builder that only exposes the remaining configuration values PR spring-projectsgh-17046

jzheaux

Thanks for your patience, @marbon87! I realized once your PR was submitted that #17181 was needed first. With that completed, I've left some inline feedback for you.

In addition to that feedback, will you please help me with your commit message as well? It looks like there isn't a blank line between your title and your sign-off message which can mess with how certain tools render the commit.

Finally, some of these changes I'd normally do for the contributor, however this is trickier when the PR is from your main branch, which I don't want to force push to. In the future, if you first cut a branch and then submit, it's a little easier for me to apply some of the needed changes.

jzheaux · 2025-05-28T22:24:48Z

oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoder.java

+	 * @param jwkSetUri the JWK Set uri to use
+	 * @return a {@link JwkSetUriJwtDecoderBuilder} for further configurations
+	 */
+	public static JwkSetUriJwtDecoderBuilder withJwkSource(JWKSource<SecurityContext> jwkSetUri) {


Please check the parameter name here. It's probably a left-over from the copy-paste.

jzheaux · 2025-05-28T22:24:58Z

oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoder.java

+	 * Use the given <a href="https://tools.ietf.org/html/rfc7517#section-5">JWK Set</a>
+	 * uri.
+	 * @param jwkSetUri the JWK Set uri to use
+	 * @return a {@link JwkSetUriJwtDecoderBuilder} for further configurations


Please add @since 7.0

jzheaux · 2025-05-28T22:26:24Z

oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoder.java

@@ -274,7 +284,7 @@ public static final class JwkSetUriJwtDecoderBuilder {
 		private static final JOSEObjectTypeVerifier<SecurityContext> NO_TYPE_VERIFIER = (header, context) -> {
 		};

-		private final Function<RestOperations, String> jwkSetUri;
+		private Function<RestOperations, String> jwkSetUri;


Since providing a JWKSource supercedes a RestOperations and a Cache, please create JwkSourceJwtDecoderBuilder instead of repurposing JwkSetUriJwtDecoderBuilder. In that way, people won't provide a JWKSource and then also try and provide a RestOperations or Cache.

Note that JwkSourceJwtDecoderBuilder will not need the validateTypes flag since that was added as part of migrating from 6.x to 7.0. Since this class will be added in 7.0, it doesn't need the same transition flag.

jzheaux · 2025-05-28T22:28:59Z

...oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoderTests.java

+	// gh-7056
+	@Test
+	public void decodeWhenUsingJwkSource() throws Exception {
+		JWKSource<SecurityContext> source = (a, b) -> {


Please use Mockito instead of an inline stub. That will allow you to use verify at the end of the test to confirm its usage

jzheaux · 2025-05-28T22:30:16Z

...oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoderTests.java

@@ -559,6 +560,22 @@ public void decodeWhenUsingSecretKeyWithKidThenStillUsesKey() throws Exception {
 		// @formatter:on
 	}

+	// gh-7056
+	@Test
+	public void decodeWhenUsingJwkSource() throws Exception {


To follow the naming convention in this file, will you please follow this format for the method name:

{methodName}When{Condition}Then{Expectation}

For example:

withJwkSourceWhenDefaultsThenUsesProvidedJwkSource

jzheaux · 2025-05-28T22:31:24Z

...oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/NimbusJwtDecoderTests.java

@@ -559,6 +560,22 @@ public void decodeWhenUsingSecretKeyWithKidThenStillUsesKey() throws Exception {
 		// @formatter:on
 	}

+	// gh-7056


This looks like it might be a stray line from a copy-paste. Since this test wasn't added as part of #7056, let's please leave it off.

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label May 6, 2025

marbon87 force-pushed the main branch 4 times, most recently from d3f0b27 to 7da453e Compare May 6, 2025 13:00

jzheaux self-requested a review May 7, 2025 22:08

jzheaux self-assigned this May 7, 2025

jzheaux added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) and removed status: waiting-for-triage An issue we've not yet triaged labels May 7, 2025

marbon87 force-pushed the main branch from 7da453e to a4a7545 Compare May 16, 2025 13:52

marbon87 force-pushed the main branch 7 times, most recently from 8b1a66c to afa71a6 Compare May 19, 2025 09:59

Add builder to create NimbusJwtDecoder with JwkSource

95e6576

Signed-off-by: Mark Bonnekessel <[email protected]>

marbon87 force-pushed the main branch from afa71a6 to 95e6576 Compare May 28, 2025 07:02

jzheaux pushed a commit to jzheaux/spring-security that referenced this pull request May 28, 2025

Add withJwkSource NimbusJwtDecoder Builder

f3753a2

PR spring-projectsgh-17046 Signed-off-by: Mark Bonnekessel <[email protected]>

jzheaux requested changes May 28, 2025

View reviewed changes

jzheaux added status: waiting-for-feedback We need additional information before we can continue type: enhancement A general enhancement labels May 28, 2025

Add possibility to customize JwkSource of NimbusJwtDecoder #17046

Are you sure you want to change the base?

Add possibility to customize JwkSource of NimbusJwtDecoder #17046

Uh oh!

Conversation

marbon87 commented May 6, 2025

Uh oh!

jzheaux commented May 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marbon87 commented May 8, 2025

Uh oh!

jzheaux commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marbon87 commented May 12, 2025

Uh oh!

jzheaux commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

marbon87 commented May 13, 2025

Uh oh!

jzheaux commented May 13, 2025

Uh oh!

marbon87 commented May 16, 2025

Uh oh!

jzheaux left a comment

Choose a reason for hiding this comment

Uh oh!

jzheaux May 28, 2025

Choose a reason for hiding this comment

Uh oh!

jzheaux May 28, 2025

Choose a reason for hiding this comment

Uh oh!

jzheaux May 28, 2025

Choose a reason for hiding this comment

Uh oh!

jzheaux May 28, 2025

Choose a reason for hiding this comment

Uh oh!

jzheaux May 28, 2025

Choose a reason for hiding this comment

Uh oh!

jzheaux May 28, 2025

Choose a reason for hiding this comment

Uh oh!

jzheaux May 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jzheaux commented May 7, 2025 •

edited

Loading

jzheaux commented May 9, 2025 •

edited

Loading

jzheaux commented May 12, 2025 •

edited

Loading