Seperate JWT Token generation

[GrmpfNarf]

Expected Behavior
It would be nice when the JWT Token generation from OAuth2ClientCredentialsAuthenticationProvider and OAuth2AuthorizationCodeAuthenticationProvider is moved to a sperate class so I can reuse it e.g. for an custom AuthenticationProvider
Current Behavior
Currently the JWT Token generation for the Access Token is inside the authenticate method of the both classes. To use it in a custom Authenticationprovider I have to copy the logic and everything around e.g. the JwtUtil and the resolve of the JwtEncoder from OAuth2ConfigurerUtils.getJwtEncoder(builder)

Context
I'm adding a custom Grant Type by adding a converter to the tokenEndpoint which provides an custom AutenticationToken which will be resolved by the custom AuthenticationProvider.

[jgrandja]

Thanks for the report @GrmpfNarf.

Hiding the Jwt token generation in the AuthenticationProvider's was intentional. However, the plan is to introduce an interface, e.g. OAuth2TokenIssuer, which can support any type of token. We'll soon be introducing opaque token support which will trigger some re-factoring.

Rest assured, the Jwt token generation will be extracted into a re-useable component, we're just not there yet.

I'll assign this to 0.2.1 but it may get pushed to a later release.

[denis111]

The same happens to me, I had to copy-paste JwtUtil besides it seems that JoseHeader needs to be public because JwtUtil returns JoseHeader.Builder if you call JwtUtils.headers() that is needed to call then JwtEncodingContext.with(headersBuilder, claimsBuilder). But I see that conflicting class JoseHeader in Spring Security 5.6 is not public! So to make any custom Provider we JoseHeader to be public or maybe the future refactoring will not require it?

[gourav]

Hi @jgrandja.
May I take this up if it is not already assigned to anyone ?

[jgrandja]

Thanks for your interest @Erised. I'm going to take this on as it touches on a few different classes and requires some refactoring and deprecation of JwtEncoder in favour of JwtEncoder that is now part of Spring Security 5.6.

[gourav]

@jgrandja Sure. Not an issue. Is there any other issue that's available ?