spring-security-jwt | Demonstrates using JWT with Spring Security | Authentication library

Why are you doing this? "Calendar" as an API is broken and obsolete, do not use it. 'Central European Standard Time' is a weird concept that probably you don't want at all. It is a broken concept you need to get rid of.

The EU has already decided that the EU as a whole is going to ditch the concept of daylight savings time entirely, but there is no actual requirement for each EU country to go to the same time zone. This means a few things:

1. It's always been an idiotic standard; There is 'Central European Standard Time' (UTC+1), and 'Central European Summer Time' (UTC+2), which both shorten to CEST, but in common parlance, 'CEST' means summer time (UTC+2), and 'Central European Standard Time' is shortened to CET. Facepalm moment.

2. Both of these zones are going to mean something completely different soon. At best, we'll be left with 'Central European Time' (CET), but that may actually end up being UTC+2, so 'CET' now refers to UTC+1, but next year it may be reinterpreted to mean UTC+2, which is hell for computers, so the best option is not to buy into this CET/CEST malarky in the first place. Whichever one isn't chosen will then be an obsolete relic: A zone that no country is actually in.

3. Maybe CET/CEST will disappear entirely: Maybe western european countries adopt UTC+1, whereas eastern ones adopt UTC+2, to match their longitudes. In a vacuum, Poland should adopt UTC+2, The Netherlands should adopt UTC+1. Then there is no 'european central time' whatsoever.

4. You already HAVE the right answer in your code: Europe/Berlin. That is how you name time zones. Not with 3-letter or 4-letter acronyms that are nebulous, overloaded, and insufficient.

But in all cases the changes are overwritten and I get UTC when calling and endpoint.

That's the problem with global defaults. 'Do not use singletons' is a common maxim, and this is why: You run into deep problems.

Yes, something is overwriting it.

The best fix is that you shouldn't need to care what the 'global' timezone property is. Whatever code you have now that uses Calendar? Find it, replace it with code based on java.time.

reference: The deprecation notice on TimeZone's javadoc about TLA time zone IDs.

The story goes basically as follows.

During Spring 4 i believe there was a single person that maintained the oauth2 part of spring security. When Spring security 5 was launched the team at pivotal decided to do a major overhaul of spring security and the oauth2 parts. So what they did was to drop Authorisation server support, and instead focus on the Resource server support at first.

Spring announcement of dropping Authorisation server support

You have pulled in spring-cloud-starter-oauth2 which in turn har a peer dependency on spring-security-oauth2-autoconfigure which in turn pulls in spring-security-oauth2.

Here Spring clearly states that if you wish to use spring-security-oauth2 they will help you out, but it is in maintenance mode.

The choice to not support it was made because an authorization server is like owning a product. Spring doesn't maintain their own database, or own Ldap server etc. There are plenty of auth servers out there that can be used, okta, curity, github, fb, google, etc, etc.

But Spring has actually reevaluated that choice and decided to start a community developed open source authorisation server

So you have 3 choices:

• use the old, that is in maintenance mode
• use a 3rd party vendor, github, fb, google, okta, curity etc.
• try out the new open source authorisation server

mvn spring-boot:run -Dspring-boot.run.jvmArguments="-Djdk.tls.client.protocols=TLSv1.2"