OAuth2 Resource Server

// ❌ BAD — pre-Security-7 API (won't compile), wrong role check, unnecessary UserDetailsService, session-based

@Configuration
@EnableWebSecurity
public class ResourceServerConfig extends WebSecurityConfigurerAdapter {  // REMOVED — gone since Security 6, still gone in 7

    @Autowired                                            // field injection
    private UserDetailsService userDetailsService;         // not needed for JWT resource server

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()                             // non-lambda DSL — removed in Security 7, won't compile
            .authorizeRequests()                          // removed in Security 7 — use authorizeHttpRequests
            .antMatchers("/api/**")                       // antMatchers removed in Security 7 — use requestMatchers
            .hasRole("ADMIN")                             // hasRole expects ROLE_ prefix, not SCOPE_
            .and()                                            // and() removed from HttpSecurity in Security 7
            .oauth2ResourceServer()                       // non-lambda style removed — use lambda DSL
            .jwt();                                       // no custom converter — roles won't map correctly

        // Session is not explicitly STATELESS — defaults to IF_REQUIRED
        // This means the server creates HTTP sessions, defeating JWT's purpose
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withJwkSetUri(
            "http://auth-server/.well-known/jwks.json")   // hardcoded URL, should use issuer-uri
            .build();
    }

    // UserDetailsService is unnecessary for resource servers —
    // the JWT token contains all claims needed for authentication
    @Bean
    public UserDetailsService userDetailsService() {
        return username -> userRepository.findByEmail(username)  // extra DB call per request!
            .map(u -> User.withUsername(u.getEmail()).password(u.getPassword()).roles("USER").build())
            .orElseThrow();
    }
}

// ✅ GOOD — JWT resource server, custom converter, scope-based auth, stateless

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class ResourceServerConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/v1/products/**").hasAuthority("SCOPE_read")
                .requestMatchers(HttpMethod.POST, "/api/v1/orders/**").hasAuthority("SCOPE_write")
                .requestMatchers("/api/v1/admin/**").hasAuthority("SCOPE_admin")
                .anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())))
            .build();
    }

    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        // Defaults read the "scope" OR "scp" claim -> SCOPE_*. Setting the claim name to
        // "scope" would drop the scp fallback that Okta and Entra ID access tokens use.
        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();

        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter);
        converter.setPrincipalClaimName("sub");
        return converter;
    }
}

package com.example.config;

import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.oauth2.jwt.Jwt;

/** Account key from an already verified access token, not a token validator. */
public record ExternalIdentity(String issuer, String subject) {
    public ExternalIdentity {
        if (issuer == null || issuer.isBlank() || subject == null || subject.isBlank()) {
            throw new BadCredentialsException("Issuer and subject are required");
        }
    }

    public static ExternalIdentity from(Jwt jwt) {
        // Preserve exact issuer and opaque subject; do not lowercase or trim either.
        return new ExternalIdentity(jwt.getClaimAsString("iss"), jwt.getSubject());
    }
}

package com.example.config;

import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.stereotype.Component;

import java.util.Collections;
import java.util.List;
import java.util.Map;

/**
 * Extracts claims from the current JWT token.
 * Inject this into services that need to know the authenticated user.
 */
@Component
public class JwtClaimExtractor {

    public ExternalIdentity getIdentity() {
        return ExternalIdentity.from(getJwt());
    }

    // Opaque provider id ("auth0|...", Okta "00u..."): map it to your user record, don't parse it.
    public String getSubject() {
        return getClaim("sub");
    }

    public String getEmail() {
        return getClaim("email");
    }

    public String getUsername() {
        return getClaim("preferred_username");
    }

    /**
     * Extract roles from standard OAuth2 scope claim.
     */
    public List<String> getScopes() {
        String scope = getClaim("scope");
        return scope != null ? List.of(scope.split(" ")) : List.of();
    }

    /**
     * Extract roles from Keycloak's nested realm_access.roles claim.
     * Only needed when using Keycloak as the identity provider.
     */
    @SuppressWarnings("unchecked")
    public List<String> getKeycloakRoles() {
        Jwt jwt = getJwt();
        Map<String, Object> realmAccess = jwt.getClaim("realm_access");
        if (realmAccess == null) return Collections.emptyList();
        Object roles = realmAccess.get("roles");
        return roles instanceof List ? (List<String>) roles : Collections.emptyList();
    }

    private String getClaim(String claimName) {
        return getJwt().getClaimAsString(claimName);
    }

    private Jwt getJwt() {
        var authentication = SecurityContextHolder.getContext().getAuthentication();
        if (authentication == null || !authentication.isAuthenticated()
                || !(authentication.getPrincipal() instanceof Jwt jwt)) {
            throw new AuthenticationCredentialsNotFoundException("Authenticated JWT required");
        }
        return jwt;
    }
}

package com.example.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
import org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.util.List;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class ResourceServerConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(AbstractHttpConfigurer::disable)
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health", "/actuator/info").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/v1/public/**").permitAll()
                .anyRequest().authenticated())
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())))
            .build();
    }

    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        // Defaults read the "scope" OR "scp" claim -> SCOPE_*. Setting the claim name to
        // "scope" would drop the scp fallback that Okta and Entra ID access tokens use.
        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();

        JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
        converter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter);
        converter.setPrincipalClaimName("sub");
        return converter;

        // For Keycloak: override to extract from realm_access.roles
        // See JwtClaimExtractor template for Keycloak-specific role extraction
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowedOrigins(List.of("http://localhost:3000")); // frontend origin
        config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        config.setAllowedHeaders(List.of("Authorization", "Content-Type"));
        config.setAllowCredentials(true);
        config.setMaxAge(3600L);

        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/api/**", config);
        return source;
    }
}