feat: add jwtDecoder to McpServerOAuth2Configurer

[stdevi]

Changes in this PR

Adding jwtDecoder to the McpServerOAuth2Configurer to set NimbusJwtDecoder.

[Kehrlann]

@stdevi thanks for contributing.

Before going further, what are you trying to accomplish with this exactly exactly?

[stdevi]

@stdevi thanks for contributing.

Before going further, what are you trying to accomplish with this exactly exactly?

I have a project where I would like to use custom rest operations for the resource server. However, this implementation does not allow configuring it. I was hoping to expose jwtDecoderCustomizer to achieve that.

[Kehrlann]

Let’s inject a full JwtDecoder instead of an customizer.

[stdevi]

@Kehrlann should I use NimbusJwtDecoder or rather JwtDecoder interface? If we use JwtDecoder, then the validateAudienceClaim won't be enforced.

[Kehrlann]

ValidateAudienceClaim is a good point.
I'm away this week, let me pick this back up next week.