JwtDecoder
@Configuration
@Slf4j
public class JwtDecoderConfig {
@NotBlank
@Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
private String issuerUri;
@NotBlank
@Value("${keycloak.truststore}")
private Resource trustStore;
@NotBlank
@Value("${keycloak.truststore-password}")
private String trustStorePw;
@Bean
public JwtDecoder jwtDecoder() {
return NimbusJwtDecoder
.withIssuerLocation(issuerUri)
.restOperations(restTemplate())
.build();
}
private RestTemplate restTemplate() {
log.info("RestTemplate for issuer-uri");
SSLContext sslContext = null;
try {
sslContext = new SSLContextBuilder()
.loadTrustMaterial(trustStore.getURL(), trustStorePw.toCharArray())
.build();
} catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException | CertificateException
| IOException e) {
log.error("ERROR while SSLContext building.", e);
return null;
}
final TlsSocketStrategy tlsStrategy = new ConscryptClientTlsStrategy(
sslContext, NoopHostnameVerifier.INSTANCE);
final HttpClientConnectionManager cm = PoolingHttpClientConnectionManagerBuilder.create()
.setTlsSocketStrategy(tlsStrategy)
.setDefaultTlsConfig(TlsConfig.custom()
.setHandshakeTimeout(Timeout.ofSeconds(30))
.setSupportedProtocols(TLS.V_1_3)
.build())
.build();
final CloseableHttpClient httpClient = HttpClients.custom()
.setConnectionManager(cm)
.build();
final var requestFactory = new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(httpClient);
return new RestTemplate(requestFactory);
}
}