How to get all user Claims with tokenOptions

[k-auth0]

Can anyone help here? Do i need any special settings in postman?

[stephanie.chamblee]

Hi @k-auth0,

Unfortunately, I’m not familiar with Spring at all, but I will try to help! Are you testing your API in Postman using the Access Token you receive after logging into the Angular app as the Bearer token in the Authorization header? Have you tried logging the token you are receiving in the API to see the entire token and decoding it at https://jwt.io/?

[k-auth0]

@stephanie.chamblee

Unfortunately, I’m not familiar with Spring at all, but I will try to help! Are you testing your API in Postman using the Access Token you receive after logging into the Angular app as the Bearer token in the Authorization header? Have you tried logging the token you are receiving in the API to see the entire token and decoding it at https://jwt.io/?

To clarify, In above scenario - Angular is out of scope. Postman is invoking endpoint, and Spring is scanning the token and printing all properties - claims, scopes permissions…

[k-auth0]

Authorization Extension not working with Spring Security

I am trying to use the authorization extensions, however, I don’t see the roles getting passed to the JWT token. Here is the decoded token… Header {"typ":"JWT","alg":"RS256","kid":"<Removed>"} Body {"iss":<Removed>,"sub":<Removed>,"aud":<removed>,"iat":<removed>,"exp":<removed>} Also Claim rolesClaim = jwt.getClaim("https://access.control/roles"); comes back null. So I don’t see the role at all. How do I find the role?

may be I have to use the below

Spring Boot Authorization Tutorial: Secure an API (Java)

[stephanie.chamblee]

I think the tutorial would be a great example to follow! You can also check out the Spring quickstart if your haven’t already: Auth0 Java Spring Boot SDK Quickstarts: Login

[k-auth0]

Still Nightmares

Spring Boot Authorization Tutorial: Secure an API (Java)

Learn how to use Spring Boot, Java, and Auth0 to secure a feature-complete API. Learn how to use Auth0 to implement authorization in Spring Boot. Read more… Brought for you by Tadej Slamic [Spring Boot Authorization Tutorial: Secure an API (Java)]

Once there was this object - AuthenticationJsonWebToken

May be it is now - @AuthenticationPrincipal OidcUser principal

The example doesn’t give enough logs to understand. I would be nice to write small example, which I think is part of unit testing, as Spring users is one huge community. Lots of ellipses in the example {…}

@DeleteMapping(“/{id}”)
@PreAuthorize(“hasAuthority(‘delete:items’)”) // New line
public ResponseEntity delete(@PathVariable(“id”) Long id) {…}

@ExceptionHandler(MethodArgumentNotValidException.class)
public ResponseEntity<Map<String, String>> handleValidationExceptions(
        MethodArgumentNotValidException ex) {...}

Too much forcing like -@EnableGlobalMethodSecurity(prePostEnabled = true) and endpoints @PreAuthorize(“hasAuthority(‘create:items’)”) is unwanted

Can anyone tell me - how can I print the claims using the above example.

[k-auth0]

Ok. Sorted

In an endpoint signature, we can add this default bean - JwtAuthenticationToken authentication

@GetMapping()
public String getSomething(final JwtAuthenticationToken authentication) {

authentication.getTokenAttributes().entrySet().stream().forEach(e → System.out.println(e.getKey()+": "+ e.getValue().toString()));

}

I have to now figure out, the minimal code needed for the functionality
https://auth0.com/blog/spring-boot-authorization-tutorial-secure-an-api-java/#