title: Spring Security 5.3 Resource Server Multiple Keys
body: <p>We have the following scenario:</p>
  <ol>
  <li>Multiple 'legacy' Spring Security Oauth2 Auth Servers (2.3.4) - each with a different RSA key configured for creation of the JWT tokens.</li>
  <li>Single newer (SS 5.3.3, SB 2.3.1) Resource Server which we want to accept tokens from <strong>either</strong> auth server.</li>
  </ol>
  <p>Problem is the resource server is only configured with 1 key (currently)- so it can only accept tokens from 1 auth-server.<br />
  Is there any conceivable way to support multiple keys in our resource server to decode JWTs coming from different auth-servers?</p>
  <p>We basically want to do this but with multiple keys:
  <a href="https://docs.spring.io/spring-security/site/docs/current/reference/html5/#oauth2resourceserver-jwt-decoder-public-key" rel="nofollow noreferrer">https://docs.spring.io/spring-security/site/docs/current/reference/html5/#oauth2resourceserver-jwt-decoder-public-key</a></p>
  <p>Spring Security 5.3 indicates this may be possible with 'multi-tenancy' <a href="https://docs.spring.io/spring-security/site/docs/current/reference/html5/#webflux-oauth2resourceserver-multitenancy" rel="nofollow noreferrer">https://docs.spring.io/spring-security/site/docs/current/reference/html5/#webflux-oauth2resourceserver-multitenancy</a></p>
  <p>It's a basic configuration</p>
  <pre><code>    @Value(&quot;${security.oauth2.resourceserver.jwt.key-value}&quot;)
      RSAPublicKey key;
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http
  
                  // using new Spring Security SpE&quot;{{LOCATOR_BASE_URL}}&quot;L
                  //https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#webflux-oauth2resourceserver-jwt-authorization
                  .authorizeRequests(authorizeRequests -&gt;
                                  authorizeRequests
  
                                          .antMatchers(&quot;/shipments/**&quot;).hasAuthority(&quot;SCOPE_DOMPick&quot;)
                                                                                 .anyRequest().authenticated()
                  )
  
                  .csrf().disable()
  
                  // ****** this is the new DSL way in Spring Security 5.2 instead of Spring Security Oauth @EnableResourceServer ******
                  .oauth2ResourceServer(oauth2ResourceServer -&gt;
                          oauth2ResourceServer
                                  .jwt(jwt -&gt;
                                          jwt.decoder(jwtDecoder())
                                  )
                  );
  
      }
  
      // static key
      @Bean
      JwtDecoder jwtDecoder() {
          return NimbusJwtDecoder.withPublicKey(this.key).build();
  </code></pre>