spring-projects / spring-projects/spring-security

Add support for reactive claim set converter in `NimbusReactiveJwtDecoder`

Open
#19,158 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Expected Behavior

NimbusReactiveJwtDecoder should support converting the claim set in a reactive way.

Current Behavior

NimbusReactiveJwtDecoder only supports configuring a blocking/imperative claim set converter (added with #6080).

Context
We use a Spring Cloud Gateway that acts as an OAuth 2 resource server and validates JWTs issued by multiple different authorization servers.
One of these authorization servers issues tokens for which we need to pre-process the claims with information that is not statically available (one of the claims represents an ID that we need to look up in a different system first, and use the response to create additional claims).

Thus, we'd expect something like this in NimbusReactiveJwtDecoder:

public void setReactiveClaimSetConverter(Converter<Map<String, Object>, Mono<Map<String, Object>>> reactiveClaimSetConverter) {
	Assert.notNull(reactiveClaimSetConverter, "reactiveClaimSetConvertercannot be null");
	this.reactiveClaimSetConverter = reactiveClaimSetConverterSetConverter;
}

Of course the logic in https://github.com/spring-projects/spring-security/blob/53bc6a77963209bb2a5f3efdd855b1f4a8051cc3/oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusReactiveJwtDecoder.java#L182-L194 would have to be refactored to perform the conversion in a reactive way.


What do you think?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/NimbusReactiveJwtDecoder.java, especially the claim conversion logic around lines 182-194. Trace how the existing blocking converter is configured and applied, then determine how reactive conversion should be exposed and integrated. Done means NimbusReactiveJwtDecoder supports the requested reactive claim set converter without removing existing imperative support.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.