Auth: JWT authentication.

[olav-valle]

TODO: JWT Auth.

Use JJWT along with Spring security. We keep all the currently implemented security code and logic structure, but implement a new custom AuthenticationManager that handles JSON Web Tokens.

This is quite straight forward when using JJWT. The required implementation is:

• A TokenConfig that can handle parsing config fields from application.config
• A Filter for the HttpSecurity builder in SecurityConfig. This extends UsernamePasswordAuthenticationFilter from Spring and replaces the default authentication manager that Spring autowires.
  • In the example from Amigoscode, a class for AuthenticationRequests is used along with this, to create an AuthenticationToken Authentication object that is sent to the AuthenticationManager during the validation process.
• A OncePerRequestFilter to handle token verification logic (TokenVerifier). The bulk of this class will be using API from JJWT, and will be used in the HttpSecurity config to handle verification of the tokens attached to incoming requests.

Reading:
jwt.io: JWT Introduction
jjwt@github