JwkTokenStore cannot be composed with custom JwtAccessTokenConverter

[pnewhook]

To get additional information stored in the JWT by the authentication server I've implemented a custom JwtAccessTokenConverter that extracts the extra claims and saves it to the OAuth2Authenticaiton. During configuration I add that custom converter to the JwtTokenStore.

But the JwkTokenStore doesn't allow a JwtAccessTokenConverter to be set, so I lose all my custom claims.

Resolving #716 would solve my use case.

[jgrandja]

Hi @pnewhook. JwkTokenStore was specifically designed to encapsulate all collaborators. We needed to do this for a couple of reasons. There are a few new classes behind the Jwk feature and we did not want to expose any of these classes at this time to avoid from extension and therefore support on our end. This is an isolated feature we implemented to support Spring Boot 1.5.

I'm assuming you can continue to use JwtTokenStore for your needs given that is what you used originally. I'm going to close this issue but if you would like to comment further please do so.

[aciccarello]

@jgrandja I would also like to override the default JwtAccessTokenConverter both to change the UserAuthenticationConverter and to perform some additional validation on the JWT. I am looking into doing this from the store but it seems more natural to modify the token converter. I imagine it could be a constructor param similar to how the JwtTokenStore is implemented.

[jgrandja]

@pnewhook @aciccarello I've added 2 constructors to JwkTokenStore that accepts a custom AccessTokenConverter, as follows:

public JwkTokenStore(String jwkSetUrl, AccessTokenConverter accessTokenConverter)

public JwkTokenStore(List<String> jwkSetUrls, AccessTokenConverter accessTokenConverter)

This will provide you full access to all the claims extracted from the Jwt so you can store it in the OAuth2Authentication if that is what you would like to do. You just need to implement the following in your custom AccessTokenConverter:

OAuth2Authentication extractAuthentication(Map<String, ?> map)

Take a look at this test as an example.