Provide custom WebClient and RestOperations to ReactiveJwtDecoders and JwtDecoders

[thiago-locatelli]

While Customize the WebClient used by OAuth2 Client Components provides a way to customize the ReactiveOAuth2AccessTokenResponseClient by providing a custom WebClient.

Spring security doesn't provide a clear way to customize the WebClient and RestOperation objects involved in the JWT decode flow of the OAuth2 authentication. This pull includes changes that allows a user to provide a custom WebClient/RestOperations to ReactiveJwtDecoders and JwtDecoders and leverage the already existing internal customizations Spring security is already doing.

[jzheaux]

Hi, @thiago-locatelli, can you share what you are doing such that NimbusJwtDecoder#withIssuerLocation is insufficient? It returns a builder that allows you to specify a RestOperations.

The main difference between NimbusJwtDecoder#withIssuerLocation and JwtDecoders is that the latter adds the IssuerValidator automatically. Otherwise it is equivalent to:

NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withIssuerLocation("https://issuer.example.org")
    // .restOperations(...)
    .build();
jwtDecoder.setJwtValidator(JwtValidators.createDefaultWithIssuer("https://issuer.example.org"));

[thiago-locatelli]

@jzheaux if there are no other difference, then in this case I will close this pull request. Thanks for providing more clarification.