security-jwt | Spring Boot Addon to add JWT based security | Authentication library

To make it work you need to provide the environment variable or put a default value.

The first option is to set the variable environment like:

And that prints -> Central European Standard Time

Why are you doing this? "Calendar" as an API is broken and obsolete, do not use it. 'Central European Standard Time' is a weird concept that probably you don't want at all. It is a broken concept you need to get rid of.

The EU has already decided that the EU as a whole is going to ditch the concept of daylight savings time entirely, but there is no actual requirement for each EU country to go to the same time zone. This means a few things:

1. It's always been an idiotic standard; There is 'Central European Standard Time' (UTC+1), and 'Central European Summer Time' (UTC+2), which both shorten to CEST, but in common parlance, 'CEST' means summer time (UTC+2), and 'Central European Standard Time' is shortened to CET. Facepalm moment.

2. Both of these zones are going to mean something completely different soon. At best, we'll be left with 'Central European Time' (CET), but that may actually end up being UTC+2, so 'CET' now refers to UTC+1, but next year it may be reinterpreted to mean UTC+2, which is hell for computers, so the best option is not to buy into this CET/CEST malarky in the first place. Whichever one isn't chosen will then be an obsolete relic: A zone that no country is actually in.

3. Maybe CET/CEST will disappear entirely: Maybe western european countries adopt UTC+1, whereas eastern ones adopt UTC+2, to match their longitudes. In a vacuum, Poland should adopt UTC+2, The Netherlands should adopt UTC+1. Then there is no 'european central time' whatsoever.

4. You already HAVE the right answer in your code: Europe/Berlin. That is how you name time zones. Not with 3-letter or 4-letter acronyms that are nebulous, overloaded, and insufficient.

But in all cases the changes are overwritten and I get UTC when calling and endpoint.

That's the problem with global defaults. 'Do not use singletons' is a common maxim, and this is why: You run into deep problems.

Yes, something is overwriting it.

The best fix is that you shouldn't need to care what the 'global' timezone property is. Whatever code you have now that uses Calendar? Find it, replace it with code based on java.time.

reference: The deprecation notice on TimeZone's javadoc about TLA time zone IDs.

You have to add @RestController to your JwtController class to make it available :)

I solved it by defining a JavaMailSender bean:

I can replicate this scenario. As others said, the reason is you have to use NoOpPasswordEncoder.getInstance() in your WebSecurityConfigurerAdapter extended class.

Well the correct term is that @EnableAuthorizationServer is in maintenance mode which basically means deprecated. As in there will be no added features or updates.

The story goes basically as follows.

During Spring 4 i believe there was a single person that maintained the oauth2 part of spring security. When Spring security 5 was launched the team at pivotal decided to do a major overhaul of spring security and the oauth2 parts. So what they did was to drop Authorisation server support, and instead focus on the Resource server support at first.

Spring announcement of dropping Authorisation server support

You have pulled in spring-cloud-starter-oauth2 which in turn har a peer dependency on spring-security-oauth2-autoconfigure which in turn pulls in spring-security-oauth2.

Here Spring clearly states that if you wish to use spring-security-oauth2 they will help you out, but it is in maintenance mode.

The choice to not support it was made because an authorization server is like owning a product. Spring doesn't maintain their own database, or own Ldap server etc. There are plenty of auth servers out there that can be used, okta, curity, github, fb, google, etc, etc.

But Spring has actually reevaluated that choice and decided to start a community developed open source authorisation server

So you have 3 choices:

• use the old, that is in maintenance mode
• use a 3rd party vendor, github, fb, google, okta, curity etc.
• try out the new open source authorisation server

if I'm not wrong you can define paths in application.properties and protect them.

Here is an example:

https://quarkus.io/guides/security-authorization

the relevant lines are:

How do I load a “user” in a micronaut backend when JWT is provided?

I am reading this as you plan to load some kind of User object your database and access it in the controller. If this is the case you need to hook into the place where Authentication instance is created to read the "sub" (username) of the token and then load it from the database.

How to extend authentication attributes with more details ?

By default for JWT authentication is created using JwtAuthenticationFactory and going more concrete default implementation is DefaultJwtAuthenticationFactory. If you plan to load more claims this could be done by replacing it and creating extended JWTClaimsSet or your own implementation of Authentication interface.

How do I access jwt claims ?

You need to check SecurityService -> getAuthentication() ->getAttributes(), it returns a map of security attributes which represent your token serialised as a map.

How to validate that the JWT is valid?

There is a basic validation rules checking the token is not expired and properly signed, all the rest validations especially for custom claims and validating agains a third parties sources have to be done on your own.

If you plan to validate your custom claims, I have already open source a project in this scope, please have a look.

https://github.com/traycho/micronaut-security-attributes

How to extend existing token with extra claims during its issuing ?

It is required to create your own claims generator extending JWTClaimsSetGenerator

Here's how you pass that variable correctly (for Spring Boot 2.X.X):

mvn spring-boot:run -Dspring-boot.run.jvmArguments="-Djdk.tls.client.protocols=TLSv1.2"