Cannot override WebClient for NimbusReactiveJwtDecoder in ReactiveOidcIdTokenDecoderFactory

[ZIRAKrezovic]

Expected Behavior

As the title says ... the NimbusReactiveJwtDecoder is created with default web client initialized statically. There is no way to change it. It should be possible to change the WebClient passed to NimbusReactiveJwtDecoder.

Current Behavior

Compared to other parts of the reactive stack, it is currently impossible to customize WebClient passed to NimbusReactiveJwtDecoder

Context

I have a Keycloak instance behind a self-signed SSL certificate. I have configured webclient instance to get it using WebClientSsl builder. But I can't pass that WebClient to NimbusReactiveJwtDecoder.

[jzheaux]

I believe it is already possible:

@Bean 
ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withIssuerLocation("https://example.org/issuer")
        .webClient(web).build();
}

or

@Bean 
ReactiveJwtDecoder jwtDecoder() {
    return NimbusReactiveJwtDecoder.withJwkSetUri("https://example.org/jwks")
        .webClient(web).build();
}

Are you having trouble with either of these approaches?

[krezovic]

Hi @jzheaux, the problem is not wit NimbusReactiveJwtDecoder itself, but rather one that is created within ReactiveOidcIdTokenDecoderFactory.

Examine the line: https://github.com/spring-projects/spring-security/blob/main/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/authentication/ReactiveOidcIdTokenDecoderFactory.java#L166

There is no way to pass WebClient to that specific instance, which is not created by myself and cannot be easily overriden due to private methods all around ...

[jzheaux]

I see, sorry that I missed that.

I think it would be reasonable to add a method to ReactiveOidcTokenDecoderFactory for specifying the WebClient. instance. Something like:

public void setWebClientFactory(Function<ClientRegistration, WebClient> webClientFactory) {
    // ...
}

Are you able to provide a PR to add that to ReactiveOidcIdTokenDecoderFactory and OidcIdTokenDecoderFactory?