How to Create JWT in OAuth2 with Spring Boot

OAuth2 is a widely used authentication protocol that enables applications to access resources on behalf of users. One of the challenges of OAuth2 is securely transmitting user information between different components of the system. To address this, OAuth2 supports the use of JSON Web Tokens (JWT) for transmitting user information. In this tutorial, we will show you how to create JWT in OAuth2 with Spring Boot.

 



Prerequisites

Before you start, you will need to have the following installed:

  • Java 8 or later
  • Maven
  • A text editor
  • Postman (or a similar REST client)

 



Creating a Spring Boot Project

The first step is to create a new Spring Boot project. You can do this by using the following command:

mvn archetype:generate -DgroupId=com.example.jwt -DartifactId=jwt -Dversion=0.0.1-SNAPSHOT -DarchetypeArtifactId=maven-archetype-quickstart -DinteractiveMode=false

 



Adding Dependencies

Next, you will need to add the following dependencies to your pom.xml file:

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-oauth2-jose</artifactId>
</dependency>

These dependencies will allow you to create a Spring Boot OAuth2 client and resource server that supports JWT.

 



Configuring the Resource Server

With the dependencies added, the next step is to configure the resource server. This is where you will specify the JWT configuration and set up the endpoint that will receive and validate the JWT.

Create a new file named ResourceServerConfig.java and add the following code:

@Configuration
@EnableResourceServer
public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Value("${security.oauth2.resource.jwt.key-value}")
    private String publicKey;

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
        resources.tokenStore(tokenStore());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated();
    }

    @Bean
    public TokenStore tokenStore() {
        return new JwtTokenStore(jwtAccessTokenConverter());
    }

    @Bean
    public JwtAccessTokenConverter jwtAccessTokenConverter() {
        JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
        converter.setVerifierKey(publicKey);
        return converter;
    }
}

This code sets up the resource server and specifies the JWT.

 



Test the JWT-based OAuth2 Implementation

Now that you have successfully implemented the JWT-based OAuth2 authorization in your Spring Boot application, it’s time to test it. You can use the Postman or cURL to send a request to the authorization server to obtain an access token.

Here’s an example of how you can use cURL to get an access token:

curl -X POST \
  http://localhost:8080/oauth/token \
  -H 'Authorization: Basic bXktdHJ1c3RlZC1jbGllbnQ6c2VjcmV0' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=password&username=user&password=password'

In the above command, the client_id is my-trusted-client and client_secret is secret. The grant_type is set to password, which means the client is asking for a resource owner password-based grant. The username and password are set to user and password, respectively.

After executing the above cURL command, you will get a JSON response like this:

{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MTYyMzkwMjJ9.tb1ZROYbK7EuLmFkb3V0GjZKdG5kO_EuM",
    "token_type": "bearer",
    "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MTYyMzkwMjJ9.tb1ZROYbK7EuLmFkb3V0GjZKdG5kO_EuM",
    "expires_in": 43199,
    "scope": "read write",
    "jti": "7c1f87b3-b22d-4ecc-9e9d-aeea4b4dfd4c"
}

The response contains an access_token, token_type, refresh_token, expires_in, scope, and jti. The access_token is the JWT token that you can use to access the protected resources.

 



Conclusion

In this blog post, you learned how to create a JWT-based OAuth2 authorization in a Spring Boot application. We covered the basic concepts of OAuth2, including authorization grants, clients, and resource servers. We also demonstrated how to use the Spring Security and Spring Boot libraries to implement an OAuth2 authorization server that generates JWT tokens.

By following the step-by-step guide, you should now be able to implement a JWT-based OAuth2 authorization in your own Spring Boot application. This implementation can serve as a starting point for your own OAuth2 authorization and authentication requirements.



Leave a Reply