JwtAuthenticationToken is Spring Security’s JWT-oriented authentication-token shape. Extend it when an application needs authentication data from JWT claims, such as a priority used in authorization. section 15.2
Customize the token in a short sequence:
- Create a subclass that passes the Jwt and authorities to the superclass and stores the additional claim. section 15.2
- Implement Converter<Jwt, CustomAuthentication> to read the claim and construct the custom token. section 15.2
- Register the converter with the OAuth2 resource-server JWT configuration. section 15.2
- Return Authentication from an endpoint or read it from the security context to verify the added data. section 15.2
Custom priority claim
A CustomAuthentication subclass can expose a priority field. A converter reads priority from the JWT, and the configured resource server places it on the authentication object returned by /demo. section 15.2
Listing 15.8 Defining a custom authentication object
public class CustomAuthentication
extends JwtAuthenticationToken { #1
private final String priority; #2
public CustomAuthentication(
Jwt jwt,
Collection<? extends GrantedAuthority> authorities,
String priority) {
super(jwt, authorities);
this.priority = priority;
}
public String getPriority() {
return priority;
}
}
Browse the Java definition of a custom JwtAuthenticationToken subclass. section 15.2
