Add Jwt Client Authentication support

[jgrandja]

Add JWT client authentication support for private_key_jwt and client_secret_jwt.

Related specifications

RFC 7521
4.2. Using Assertions for Client Authentication

RFC 7523
2.2. Using JWTs for Client Authentication

OpenID Connect Core 1.0
9. Client Authentication

The best place to start to see how to configure and customize JWT client authentication support are the following tests:

• DefaultAuthorizationCodeTokenResponseClientTests:

  • getTokenResponseWhenAuthenticationPrivateKeyJwtThenFormParametersAreSent()
  • getTokenResponseWhenAuthenticationClientSecretJwtThenFormParametersAreSent()

• DefaultClientCredentialsTokenResponseClientTests:

  • getTokenResponseWhenAuthenticationPrivateKeyJwtThenFormParametersAreSent()
  • getTokenResponseWhenAuthenticationClientSecretJwtThenFormParametersAreSent()

Closes gh-8175

[rwinch]

I've left feedback inline

[jgrandja]

@rwinch I have addressed all feedback. Ready for next review.

[rwinch]

Thanks. I think it is getting very close. I have responded to some of your replies.

[rwinch]

Is there a reason you went with creating JwtClientAuthenticationContext vs two converters like was done with the headers and claims in AbstractOAuth2AuthorizationGrantRequestEntityConverter

[jgrandja]

See comment

[jgrandja]

Thanks for all the feedback @rwinch !

I applied the last bit of feedback and just merged to master.

[sabareeshkkanan]

@jgrandja do you have an working example by configuring using application.yml, trying to get this working for apple but no luck so far. Also went through the test but still cant able to get it working

[jgrandja]

@sabareeshkkanan

do you have an working example by configuring using application.yml

NimbusJwtClientAuthenticationParametersConverter cannot be auto-configured from application.yml. It needs to be explicitly configured by passing it a Function<ClientRegistration, JWK> jwkResolver via constructor. The jwkResolver contains the key used to sign the Jwt Client assertion.

Please look at this test as it demonstrates the explicit code configuration.

[sabareeshkkanan]

@jgrandja It is still hard to understand how this can be done in a real world that is not a Test. Do you have an working example

[jgrandja]

I will try to find time over the next week or so to put a sample together.

[jgrandja]

@sabareeshkkanan This branch has a working sample that uses Spring Authorization Server.