Enriching a Google JWT with Roles and enabling the PreAuthorize annotaiton
Google SSO is great for generating a valid JWT your can use with Spring Security's OAuth2, but how do we make Spring Security aware of the Google user's roles/authorities to EnableMethodSecurity annotations like PreAuthorize?
As documented in this Spring Boot 3 application, you'll have to implement your own custom JwtAuthenticationConverter that sets the List of GrantedAuthority authorities manually from a PostgreSQL database in this case.
🌎 Find Me Here:
Twitter: / peterlinnehan
GitHub: https://github.com/pjl-software/full-...
LinkedIn: / peterlinnehan
#coding #springboot #jpa #springsecurity #angular #fullstackdevelopment #oauth2
Chapters
0:00 - Demo of API Role Enforcement with Google JWT
2:14 - Video Learning Objectives
4:01 - Manually extracting JWT user Authorities with Spring Security
6:48 - The CustomJwtAuthenticationConverter
8:37 - Add Role-based Protections to API Endpoints with PreAuthorize
9:52 - Extend AuthenticationPrincipal to Return a User entity