spring-projects / spring-projects/spring-security
Support for JWT claims from RFC 9068
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
RFC 9068 defines the claims "roles", "groups", and "entitlements", which can be useful for transmitting standardised information. These are structured values from SCIM defined by RFC 7643.
Some support in parsing them would be nice. Ideally a getRoles() method somewhere returning e.g. List<SCIMRole> etc.
Current Behavior
The claims set is typed as just a Map<String, Object, requiring a lot of casting (often unchecked) and verification to get at these structures.
Context
Mapping these concepts to ROLE_ authorities and ACL domain principals rather than having to do full user lookups (which may not be possible in some architectures) at the resource server.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating Spring Security's JWT claims representation, then read RFC 9068 and RFC 7643 for the roles, groups, and entitlements structures. Done means these claims can be accessed as typed values without unchecked casts, with coverage for the supported claim shapes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100