title: JWT bearer exchange for access token request using Spring Security OAuth2
body: <p>I have a working setup that includes:</p>
  
  <ul>
  <li>Authorization Service (AS)</li>
  <li>Resource Service (RS)</li>
  <li>Relying Party (RP)</li>
  </ul>
  
  <p>Implementation is based on Spring Boot with Spring Security (OAuth2). I have the following working 2LA flow:</p>
  
  <ol>
  <li>RP is able to send a request for an access token to AS using <code>client_secret</code> and <code>grant_type=client_credentials</code>. </li>
  <li>AS responds with an access token to RP. </li>
  <li>RP is able to make an authorized request to RS using said access token. </li>
  <li>RS is able to verify the access token using <code>/check_token</code> endpoint on AS.</li>
  </ol>
  
  <p><strong>Question</strong> What changes do I need to make to my AS that it accepts JWT based request for an access token in step 1 above? </p>
  
  <p>Note that I don't need a JWT based access token. Only the initial request by the RP to the AS for an access token should be a JWT based request.</p>
  
  <p>Related question: <a href="https://stackoverflow.com/questions/28540044/how-to-use-spring-oauth2-jwt-token">How to use Spring OAuth2 JWT Token?</a></p>
  
  <p><strong>Clarification</strong> I'd like to know what <code>code</code> I need to write in order to accept a JWT from RP using Spring Security OAuth2 library. Where do I add RP's public key to AS and where do I add RP's private key to the OAuth2 rest template?</p>
  
  <p>RP OAuth2 Client Configuration:</p>
  
  <pre><code>@Configuration
  @EnableOAuth2Client
  open class OAuth2ClientConfiguration {
  
      val tokenUrl = "http://localhost:8180/oauth/token"
  
      @Bean
      open fun resource(): OAuth2ProtectedResourceDetails {
          return ClientCredentialsResourceDetails().apply {
              clientId = "demo-rp"
              clientSecret = "rp-secret"
              grantType = "client_credentials"
              scope = listOf("quotes")
              accessTokenUri = tokenUrl
          }
      }
  
      @Bean
      open fun restTemplate(): OAuth2RestOperations {
          return OAuth2RestTemplate(
                  resource(),
                  DefaultOAuth2ClientContext(DefaultAccessTokenRequest()))
      }
  
  }
  </code></pre>
  
  <p>AS OAuth2 Configuration:</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  open class OAuth2Configuration : AuthorizationServerConfigurerAdapter() {
  
      @Autowired
      val authenticationManager: AuthenticationManager? = null
  
      override fun configure(security: AuthorizationServerSecurityConfigurer) {
          // @formatter:off
          security
          .tokenKeyAccess("isAnonymous() || hasAuthority('ROLE_TRUSTED_CLIENT')")
          .checkTokenAccess("hasAuthority('ROLE_TRUSTED_CLIENT')")
          // @formatter:on
      }
  
      override fun configure(clients: ClientDetailsServiceConfigurer) {
          // @formatter:off
          clients.inMemory()
          .withClient("demo-rp")
              .authorizedGrantTypes("client_credentials")
              .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
              .scopes("quotes")
              .secret("rp-secret")
              .accessTokenValiditySeconds(60)
          .and()
          .withClient("demo-rs")
              .authorizedGrantTypes("client_credentials")
              .authorities("ROLE_CLIENT", "ROLE_TRUSTED_CLIENT")
              .secret("rs-secret")
              .accessTokenValiditySeconds(60)
          // @formatter:on
      }
  
      override fun configure(endpoints: AuthorizationServerEndpointsConfigurer) {
          // @formatter:off
          endpoints
          .authenticationManager(authenticationManager)
          // @formatter:on
      }
  }
  </code></pre>