SSL bundle support for OAuth2 Resource Servers (for the JWK Set request) is being actively worked on in #50280.
This is a feature request to add symmetric SSL bundle support for OAuth2 Clients.
Today, configuring SSL for OAuth2 Clients requires taking ownership of a large portion of the Spring Security wiring. This complexity is probably better handled by Spring Boot using the standard SSL bundle mechanism.
One idea would be to attach the SSL bundle configuration to the provider (spring.security.oauth2.client.provider.<provider-id>.ssl.bundle) rather than to each individual client registration (spring.security.oauth2.client.registration.<client-registration-id>.ssl.bundle) since the TLS material is a property of the provider (Authorization Server).
Note that implementing this for OAuth2 Clients might be much more involved than implementing it for OAuth2 Resource Servers due to the number of different HTTP clients that are used:
- various token response clients (
RestClient{AuthorizationCode,ClientCredentials,RefreshToken,JwtBearer,TokenExchange}TokenResponseClient) and their WebClient variants
- a user info client (
DefaultOAuth2UserService / OidcUserService)
NimbusJwtDecoder- potentially
ClientRegistrations
SSL bundle support for OAuth2 Resource Servers (for the JWK Set request) is being actively worked on in #50280.
This is a feature request to add symmetric SSL bundle support for OAuth2 Clients.
Today, configuring SSL for OAuth2 Clients requires taking ownership of a large portion of the Spring Security wiring. This complexity is probably better handled by Spring Boot using the standard SSL bundle mechanism.
One idea would be to attach the SSL bundle configuration to the provider (
spring.security.oauth2.client.provider.<provider-id>.ssl.bundle) rather than to each individual client registration (spring.security.oauth2.client.registration.<client-registration-id>.ssl.bundle) since the TLS material is a property of the provider (Authorization Server).Note that implementing this for OAuth2 Clients might be much more involved than implementing it for OAuth2 Resource Servers due to the number of different HTTP clients that are used:
RestClient{AuthorizationCode,ClientCredentials,RefreshToken,JwtBearer,TokenExchange}TokenResponseClient) and their WebClient variantsDefaultOAuth2UserService/OidcUserService)NimbusJwtDecoderClientRegistrations