Define JSON Web Key Set for Authorization Server using Spring Authorization Server and PKCS12 key store file

The JSON Web Key Set is a collection of JSON Web Key public keys provided by the Authorization Server so that the Resource Server can verify the access token sent by the Client Application. In the tutorial about implementing OAuth Authorization Server using Spring Authorization Server, I showed you how to define this JSON Web Key using code. But for applications running in production, for security reasons, the JSON Web Key information will often be managed by another party, possibly the IT team. They will generate a keystore file, our task is to use this keystore file to define the JSON Web Key Set. In this tutorial, I will show you how to define JSON Web Key Set for Authorization Server using Spring Authorization Server and PKCS12 key store file.

First, I will generate a keystore file with PKCS12 format as an example.

The following results:

Usually, we will expose the environment variable pointing to the path of the .pfx file for their IT team to configure. But for the sake of simplicity in this tutorial, I will put this .pfx file in the src/main/resources folder of the example project in the tutorial Implement OAuth Authorization Server using Spring Authorization Server:

We will initialize Java Security’s KeyStore object to hold the information of the .pfx file as follows:

There are several overloads of the getInstance() method that you can use. Here, I am using getInstance() with the parameter being the type of the keystore file. You can see all the keystore types that Java supports here.

If you use a password to protect the keystore file, you can get the content of the keystore file as follows:

123456 is the password of keystore file.

After you have loaded the content of the keystore file, you can convert this content to the JWKSet object of the Nimbus library, the library that Spring Authorization Server is using to work with the access token, as follows:

When converting the content of the keystore file to the JWKSet object, we need to pass the password information of the private key. With keystore type PKCS12, the password of the private key is the same as the password of the keystore file.

The entire content of the method to build my JWKSet object information is as follows:

You can use this method when building your Authorization Server using Spring Authorization Server! Declare the JWKSource object now in the Spring container as follows:

You can use the JWKSet build code for any keystore!

10 thoughts on “Define JSON Web Key Set for Authorization Server using Spring Authorization Server and PKCS12 key store file

  1. Hi Khanh
    I use PKCS12 key without any problem. but my resource server not working.
    what do i for spring resource server?
    sorry for my english skill problems 🙂

      1. my spring resource-server can not connect to authorization-server when change key to PKCS12 in authorization-server

  2. Hi Khanh,
    Thank you for putting this article together. I am attempting to substitute my own .pfx file into the code from your tutorial on creating a Spring Authorization Server. I did follow along your VERY helpful post on Generating keystore using keytool in Java. However, now, when I run my code (your code from git actually!), but substitute in my new pfx file, it cannot run as a is thrown with the following output: “DER input, Integer tag error”

    I was wondering if you experienced this and if you have any pointers. By the way, do you have a ko-fi account or similar where I could send you a few Euro to thank you for your help so far?

      1. Hey Khanh,

        Thank you for the link. BUt I am not sure it helps me. What I did was a two step process:

        To generate my own pfx file I ran:
        1. keytool -genkeypair -alias auth-server -keyalg RSA -keystore “C:/Program Files/Java/jdk1.8.0_291/jre/lib/security/cacerts” -keypass password123 -storepass changeit -storetype PKCS12

        Then, to export this as a pfx file (so I could import it into src/main/resources of the project) I ran:
        2. keytool -exportcert -keystore cacerts -alias auth-server -file auth-server.pfx

        (just sent you a thank you on PayPal!)

        1. Hi Niall,

          To get the .pfx file, you only need run one command, for example:

          and then put the generated .pfx file into the src/main/resources folder.

          Can you try again?

          P/S: I received your donation, thank so much.

        2. When you point output path to program files .. you are supposed to open command prompt as administrator ..
          Point out to any other folder which you have access like downloads/documents/d drive/ etc .

Add Comment