Add support for auto-configuring ExpressionJwtGrantedAuthoritiesConverter

[kalgon]

Currently, the auto-configured JwtAuthenticationConverter (defined in OAuth2ResourceServerJwtConfiguration) uses a JwtGrantedAuthoritiesConverter. It would be nice if an ExpressionJwtGrantedAuthoritiesConverter would be used if there is a property spring.security.oauth2.resourceserver.jwt.authorities-claim-expression.

[wilkinsona]

Thanks for the suggestion. On the face of it, this seems reasonable. However, I'm not sure exactly how ExpressionJwtGrantedAuthoritiesConverter is typically used, in particular its javadoc mentions using it in combination with DelegatingJwtGrantedAuthoritiesConverter which may not lend itself to property-based configuration. I couldn't find anything in Spring Security's documentation so I have opened spring-projects/spring-security#18300.

[kalgon]

Personally, I am not using it with a DelegatingJwtGrantedAuthoritiesConverter. I am defining a JwtAuthenticationConverter the same way it is defined in OAuth2ResourceServerJwtConfiguration but with an ExpressionJwtGrantedAuthoritiesConverter (instead of a regular JwtGrantedAuthoritiesConverter) so that I could have the following in my configuration (I am using keycloak):

spring.security.oauth2.resourceserver.jwt.authorities-claim-expression=["resource_access"]["my.client.id"]["roles"]

[yashpawarrr]

Hi there ! Respected open source community I am Yash and I am in my Second year of college , exploring spring boot , java and scalable architecture . Gladly found your github repository and I'll be happy to be a part of this . So may you please guide me how can i start my contribution as soon as possible ....

[wilkinsona]

@yashpawarrr thank you for the offer, but there's nothing to start at the moment. We are awaiting some feedback from the Spring Security team regarding spring-projects/spring-security#18300.

[ewoerner]

Keycloak user here. I suspect the Javadoc of ExpressionJwtGrantedAuthoritiesConverter is written with Keycloak users in mind.

Keycloak has the concept of realm roles (global to the realm) and client roles (restricted to one specific client). Therefore, if you want access to all of them in your code, you need a DelegatingJwtGrantedAuthoritiesConverter with two ExpressionJwtGrantedAuthoritiesConverters, one for ["resource_access"]["my.client.id"]["roles"] and one for ["realm_access"]["roles"].
The original feature request in Spring Security has an example JWT: spring-projects/spring-security#15201 (comment)

Note that the old Keycloak Spring adapter never had support for combining both realm and client roles due to lack of demand (https://issues.redhat.com/browse/KEYCLOAK-8376). You had to choose between realm roles (useResourceRoleMappings=false) and client roles (useResourceRoleMappings=true), or provide your own JwtGrantedAuthoritiesConverter.

[wilkinsona]

Thank you, @ewoerner. That's exactly the kind of information I was looking for. So we need to support configuring multiple expressions and the creation of a delegating converter.