Ankur Mhatre
4dc45d5e00
Companion code for the follow-up article. The repository now holds two Maven
projects sharing one docs/ tree:
jwt-authentication/ the hand-written filter application (unchanged, moved)
oauth2-resource-server/ a resource server, a Keycloak compose, and a stub
issuer whose JWK Set can be mutated on command
The stub exists because Keycloak will not rotate a signing key at a chosen
second, report how many times its JWKS endpoint was fetched, or drop a key from
the published set on request - and the caching and rotation measurements need
all three. The Keycloak run confirms the same code path against a real issuer.
Findings captured under docs/output/, all from real runs:
* The default validator stack does not check aud. A token minted for another
service in the same realm is accepted.
* Spring Security builds its JWKSource with refreshAheadCache(false) and
rateLimited(false), overriding two of Nimbus's protective defaults, and
enables Nimbus caching only when NO Spring cache was supplied - so
supplying one removes the five-minute expiry.
* A key retired from the JWK Set stops being accepted at t+300s with the
default cache, and never with a Spring cache that has no TTL.
* 25 tokens carrying an unknown kid produce 25 JWKS fetches at the issuer,
through permitAll() endpoints included.
* A hyphenated client id in an authorities-claim-expression parses as
subtraction; the SpelEvaluationException is swallowed and logged at TRACE.
* A clientScopes key in a Keycloak realm import replaces the built-in scopes
rather than adding to them.
New docs chapters 12-18. README covers both projects. Existing docs and scripts
updated for the new paths; no docs/output/ file from the first article moved, so
links in the published article still resolve.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013f7f2XZXrQ6gW3RtZE187t
129 lines
2.8 KiB
JSON
129 lines
2.8 KiB
JSON
{
|
|
"realm": "demo",
|
|
"enabled": true,
|
|
"sslRequired": "none",
|
|
"accessTokenLifespan": 300,
|
|
"roles": {
|
|
"realm": [
|
|
{
|
|
"name": "USER",
|
|
"description": "Ordinary user"
|
|
},
|
|
{
|
|
"name": "ADMIN",
|
|
"description": "Administrator"
|
|
}
|
|
],
|
|
"client": {
|
|
"reports-api": [
|
|
{
|
|
"name": "reports-reader",
|
|
"description": "May read reports"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"clients": [
|
|
{
|
|
"clientId": "reports-api",
|
|
"enabled": true,
|
|
"bearerOnly": true,
|
|
"protocol": "openid-connect",
|
|
"description": "The resource server. It never logs anyone in; it only owns roles and is an audience."
|
|
},
|
|
{
|
|
"clientId": "demo-client",
|
|
"enabled": true,
|
|
"publicClient": false,
|
|
"secret": "demo-secret",
|
|
"standardFlowEnabled": false,
|
|
"directAccessGrantsEnabled": true,
|
|
"serviceAccountsEnabled": false,
|
|
"protocol": "openid-connect",
|
|
"fullScopeAllowed": true,
|
|
"protocolMappers": [
|
|
{
|
|
"name": "reports-api-audience",
|
|
"protocol": "openid-connect",
|
|
"protocolMapper": "oidc-audience-mapper",
|
|
"consentRequired": false,
|
|
"config": {
|
|
"included.client.audience": "reports-api",
|
|
"id.token.claim": "false",
|
|
"access.token.claim": "true"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"users": [
|
|
{
|
|
"username": "alice",
|
|
"enabled": true,
|
|
"emailVerified": true,
|
|
"firstName": "Alice",
|
|
"lastName": "Anderson",
|
|
"email": "alice@example.com",
|
|
"requiredActions": [],
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "alice-password",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"realmRoles": [
|
|
"USER"
|
|
],
|
|
"clientRoles": {
|
|
"reports-api": [
|
|
"reports-reader"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"username": "root",
|
|
"enabled": true,
|
|
"emailVerified": true,
|
|
"firstName": "Root",
|
|
"lastName": "Admin",
|
|
"email": "root@example.com",
|
|
"requiredActions": [],
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "root-password",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"realmRoles": [
|
|
"USER",
|
|
"ADMIN"
|
|
],
|
|
"clientRoles": {
|
|
"reports-api": [
|
|
"reports-reader"
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"username": "nobody",
|
|
"enabled": true,
|
|
"emailVerified": true,
|
|
"firstName": "No",
|
|
"lastName": "Body",
|
|
"email": "nobody@example.com",
|
|
"requiredActions": [],
|
|
"credentials": [
|
|
{
|
|
"type": "password",
|
|
"value": "nobody-password",
|
|
"temporary": false
|
|
}
|
|
],
|
|
"realmRoles": [
|
|
"USER"
|
|
]
|
|
}
|
|
]
|
|
} |