JwtProvider (security.providers.jwt) Configuration

JwtProvider (security.providers.jwt) Configuration

JWT authentication provider

Type: io.helidon.security.providers.jwt.JwtProvider

Config key

jwt

Copied

This type provides the following service implementations:

io.helidon.security.spi.SecurityProvider
io.helidon.security.spi.AuthenticationProvider

Configuration options

Optional configuration options

key	type	default value	description
`allow-impersonation`	boolean	`false`	Whether to allow impersonation by explicitly overriding username from outbound requests using EndpointConfig.PROPERTY_OUTBOUND_ID property. By default this is not allowed and identity can only be propagated.
`allow-unsigned`	boolean	`false`	Configure support for unsigned JWT. If this is set to `true` any JWT that has algorithm set to `none` and no `kid` defined will be accepted. Note that this has serious security impact - if JWT can be sent from a third party, this allows the third party to send ANY JWT and it would be accpted as valid.
`atn-token.handler`	TokenHandler		Token handler to extract username from request.
`atn-token.jwk.resource`	Resource		JWK resource used to verify JWTs created by other parties.
`atn-token.jwt-audience`	string		Audience expected in inbound JWTs.
`atn-token.verify-signature`	boolean	`true`	Configure whether to verify signatures. Signatures verification is enabled by default. You can configure the provider not to verify signatures. <b>Make sure your service is properly secured on network level and only accessible from a secure endpoint that provides the JWTs when signature verification is disabled. If signature verification is disabled, this service will accept <i>ANY</i> JWT</b>
`authenticate`	boolean	`true`	Whether to authenticate requests.
`optional`	boolean	`false`	Whether authentication is required. By default, request will fail if the username cannot be extracted. If set to false, request will process and this provider will abstain.
`principal-type`	SubjectType (USER, SERVICE)	`USER`	Principal type this provider extracts (and also propagates).
`propagate`	boolean	`true`	Whether to propagate identity.
`sign-token`	OutboundConfig		Configuration of outbound rules.
`sign-token.jwk.resource`	Resource		JWK resource used to sign JWTs created by us.
`sign-token.jwt-issuer`	string		Issuer used to create new JWTs.
`use-jwt-groups`	boolean	`true`	Claim `groups` from JWT will be used to automatically add groups to current subject (may be used with jakarta.annotation.security.RolesAllowed annotation).