A JWKSource supplies the key material that a Spring Security authorization server uses to sign non-opaque tokens, such as JWTs. The server exposes corresponding public keys so clients can validate token authenticity. section 14.1
Configure JWKSource with these responsibilities in mind:
- Provide a set of signing keys through a JWKSource<SecurityContext> bean. section 14.1
- Generate or load an RSA key pair, package it as an RSAKey, and assign it a key ID. section 14.1
- Store production keys securely and preserve them across deployments; regenerating them on restart invalidates previously issued tokens. section 14.1
- Use JWKSource for non-opaque tokens; opaque-token deployments instead rely on resource-server introspection. section 14.6
Programmatic RSA configuration
A minimal configuration creates a 2048-bit RSA pair, wraps its public and private keys in RSAKey, assigns a generated key ID, and returns the configured key source. This is suitable for demonstration, not for deployments where issued tokens must survive restarts. section 14.1
Figure 14.2 The components we need to configure and plug in for an authorization server implemented with Spring Security to work
Use the component diagram to place JWKSource alongside the authorization server’s protocol, client, user, and endpoint configuration. section 14.1
