Question: API against OpenId / OAuth2 about tomcat-jwt-security HOT 1 CLOSED

Hi and thanks for using the Valve!

I didn't try specifically with Google or GitHub, but it should work with all OpenId compliant IDP, since they expose the "well-known" endpoint.
For example, Google's one is "https://accounts.google.com/.well-known/openid-configuration", and its jwks_uri value is "https://www.googleapis.com/oauth2/v3/certs": this is the value to use for parameter issuerUrl.
So, you can just configure the valve like this:

<Valve className="it.cosenonjaviste.security.jwt.valves.OidcJwtTokenValve" 
          issuerUrl="https://www.googleapis.com/oauth2/v3/certs"
          expiresIn="30"
          timeUnit="MINUTES" />

and it should work with token emitted by google. Certificates downloaded from "https://www.googleapis.com/oauth2/v3/certs" will be cached internally for 30 minutes.
This is the correct configuration if JWT emitted has a long duration. For example, on Salesforce or Keycloack, you can set JWT duration and you can use this valve easily like shown above.

However, I don't know how long a JWT emitted by Google is valid: if you cannot control its duration, maybe this is not the right approach. Usually, social login emit a token valid just for 3 minutes, where you have just time to gather some information from the token, then it expires and you cannot use it for further authentication.
In this case, what I usually do is to intercept the successful social login and emit another (private) JWT signed by me, so I can use the HmacJwtTokenValve or RsaJwtTokenValve, since I own secrets.

Let me know if this can help!
Cheers

from tomcat-jwt-security.