A public key set URI is an authorization-server endpoint that exposes the public parts of its signing key pairs. An OAuth 2 resource server calls it to obtain keys for validating JWT access-token signatures, while the authorization server keeps the private parts for signing. section 15.1 section 15.5
A Spring resource server uses the URI in a short configuration sequence:
- Expose or locate the authorization server’s OpenID Connect configuration, such as http://localhost:8080/.well-known/openid-configuration. section 15.1
- Read the jwks_uri value, for example http://localhost:8080/oauth2/jwks, from that configuration. section 15.1
- Store the URI in application.properties and inject it into the configuration class. section 15.1
- Pass the property to oauth2ResourceServer().jwt().jwkSetUri(), then require authentication for the protected requests. section 15.1
JWT validation in a Spring resource server
Configure keySetURI=http://localhost:8080/oauth2/jwks, inject it as keySetUri, and connect it to Spring Security with http.oauth2ResourceServer(c -> c.jwt(j -> j.jwkSetUri(keySetUri))). Add http.authorizeHttpRequests(c -> c.anyRequest().authenticated()), expose a /demo endpoint, and call it with a Bearer access token. section 15.1
Figure 15.2 The resource server retrieves a set of public keys from the authorization server through an endpoint made available by the authorization server. The resource server then uses these keys to verify the signature of the access token.
The flow shows the resource server retrieving public keys from the authorization server and using them to verify an access-token signature. section 15.1
