I'm using Spring Security 6 using Nimbus token. Here is my security configuration ..
@Bean
public JwtDecoder jwtDecoder() {
return NimbusJwtDecoder.withPublicKey( jwtConfigProperties.getPublicKey()).build();
}
@Bean
public JwtEncoder jwtEncoder(){
JWK jwk = new RSAKey.Builder( jwtConfigProperties.getPublicKey()).privateKey(jwtConfigProperties.getPrivateKey()).build();
JWKSource<SecurityContext> jwks = new ImmutableJWKSet<>(new JWKSet(jwk));
return new NimbusJwtEncoder(jwks);
}
Here's my jwt configuration properties for RSA public and private key..
public class RsaKeyProperties {
private RSAPrivateKey privateKey;
private RSAPublicKey publicKey;
@Autowired
KeyGeneratorUtility keygen;
@PostConstruct
public void init() {
KeyPair keyPair = keygen.generateKey();
this.privateKey = (RSAPrivateKey) keyPair.getPrivate();
System.out.println("rsa private key : "+privateKey);
this.publicKey = (RSAPublicKey) keyPair.getPublic();
System.out.println("rsa public key : "+publicKey);
}
}
And here's to generate RSA public and private key programmatically.
public class KeyGeneratorUtility {
public KeyPair generateKey() {
KeyPair keyPair;
try{
KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
keyPairGenerator.initialize(2048);
keyPair = keyPairGenerator.generateKeyPair();
} catch(Exception e){
throw new IllegalStateException();
}
return keyPair;
}
}
And here is to generate token programmatically.
public String generateToken(ProductUser produser) {
Instant now = Instant.now();
String scope = produser.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.joining(" "));
JwtClaimsSet claims = JwtClaimsSet.builder()
.issuer("self")
.issuedAt(now)
.expiresAt(now.plus(1, ChronoUnit.HOURS))
.subject(produser.getUsername())
.claim("scope", scope)
.build();
return this.encoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
}
This is an auto-generated token after hitting API from postman with status 200 OK
eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJzZWxmIiwic3ViIjoic2F5YW50YW51c2VyIiwiZXhwIjoxNjkyNzY1MTU5LCJpYXQiOjE2OTI3NjE1NTksInNjb3BlIjoidXNlcjpjcmVhdGUgdXNlcjpkZWxldGUgdXNlcjp1cGRhdGUgdXNlcjpyZWFkIFJPTEVfVVNFUiJ9.LtLP0YcniqgKbhqMkTOWtBMqGLKP1nk5xKWZhELmsISCFTPmMbCVCAPikJqz9psW3QjoMWgbOoia3_saohrbPI1EfTIYb_P0K5bh3eD2StIK0B4ywf39-ENvzE9Zt9GuRTWHQ7tk1cBJv9YhqZxDzmFbZdPDBB1ZWYXGLxBhKec8vVlidGA0UqPKNiZhSFoop3mjmzu2N4kah7WZ__q20ccFeS52icKXyw8kpFbxiasouWRLPjy75nwgcYhXASKfs5TSYPyzppCTE1cqQ3CzVOv21xpzK6QjD9hnTz8aqrsz8mFTFxd0VRqenwLx1s9SiHldfG0DK_umd9w_83muoQ
But after pasting this token with JWT.io it is showing invalid signature
An idea what am I doing wrong? Is my approach incorrect? Please help me out.