java jwe/jws,在Spring Boot中使用Keycloak实现JWT，JWE和JWS（带签名的JWT）

I try to implement a simple OAuth2 "Client Authentication with Signed JWT" Demo App using Spring Boot and Keycloak as AuthService.

The idea is:

one secured REST service "The Producer"

offering an endpoint GET /person for all users/principals with the role "read_person"

offering an endpoint POST /person for all users/principals with the role "write_person"

another (unsecured) REST service "The Consumer"

offering an enpoint /api open for everybody

calling internal the "producer" viaFeignclient using an RequestInterceptor to pass the AccessToken (signed JWT / JWS)

I read about the docs:

saying:

Once the client application is started, it allows to download its public >key in JWKS format using a URL such as http://myhost.com/myapp/k_jwks, >assuming that http://myhost.com/myapp is the base URL of your client >application. This URL can be used by Keycloak (see below).

During authentication, the client generates a JWT token and signs it with >its private key and sends it to Keycloak in the particular backchannel >request (for example, code-to-token request) in the client_assertion >parameter.

I googled a lot to find tutorials/demos or docs about this topic but failed so far.

So here my questions:

How do I implement this "k_jwk" endpoint? Do I simple build a @RestController by myself in "the Producer"? How do I configure Keycloak to get aware of this URL?

How do I implement my "Consumer" to get fresh signed JWT from Keycloak?

Update

Removed irritating PS statement.

解决方案

You don't need to implement the k_jwk endpoint, this is handled by the adapter. Keycloak will by default look at http:///your.app.com/k_jwk(but if needed you can override that in the console).

Then you need to configure your Spring Boot client, just use the same properties as the keycloak.json but in the application.properties format:

...

keycloak.credentials.jwt.client-keystore-file=classpath:keystore-client.jks

keycloak.credentials.jwt.client-keystore-type=JKS

etc ...

You need a token to call the producerbut as you said the entry point will be an insecured endpoint so you might want to use a Service Account for this.

I hope this will help.