Custom JWT authentication converter is ignored about okta-spring-boot

[Draudastic26]

When I use spring-boot-starter-oauth2-resource-server and remove okta-spring-boot-starter dependency, it works as expected.
Of course you have to move issuer uri from okta.oauth2.issuer to spring.security.oauth2.resourceserver.jwt.issuer-uri

[arvindkrishnakumar-okta]

@Draudastic26 Thanks for posting!

I'd like to understand a bit more about your use case and the need for a custom JWT Authentication Converter. The Okta Springboot starter provides a converter that automatically takes care of converting claims in tokens to authorities.

Are you sure you are adding your custom JwtAuthenticationConverter bean to the SecurityChain in your oauth2ResourceServer config?

[Draudastic26]

Our customer has their own Okta instance and the required info for our backend is just available in the id_token via the okta userinfo endpoint. Also the authorities (RACF and AD groups) are just available in the id_token via custom claims. This setup is fix and can't be configured. My idea was to convert the JWT into an extended version of the JwtAuthenticationToken with the required fields from the userinfo endpoint. With that, I could also use the handy @PreAuthorize annotation. Everything works as expected, but only with the spring-boot-starter-oauth2-resource-server dependency and not with this okta lib.

The security chain looks like this:

@Bean
fun filterChain(http: HttpSecurity): SecurityFilterChain {
    http {
        authorizeRequests {
            authorize(anyRequest, authenticated)
        }
        oauth2ResourceServer {
            jwt {
                jwtAuthenticationConverter = CustomJwtConverter()
            }
        }
    }
    return http.build()
}

EDIT: I use Kotlin

[arvindkrishnakumar-okta]

@Draudastic26 Can you please check if this is still an issue with 3.0.3?