JwtProvider (security.providers.jwt) Configuration

JWT authentication provider

Type: io.helidon.security.providers.jwt.JwtProvider

Config key

jwt

This type provides the following service implementations:

io.helidon.security.spi.SecurityProvider
io.helidon.security.spi.AuthenticationProvider

Configuration options

Table 1. Optional configuration options
key	type	default value	description
`allow-impersonation`	boolean	`false`	Whether to allow impersonation by explicitly overriding username from outbound requests using io.helidon.security.EndpointConfig.PROPERTY_OUTBOUND_ID property. By default this is not allowed and identity can only be propagated.
`allow-unsigned`	boolean	`false`	Configure support for unsigned JWT. If this is set to `true` any JWT that has algorithm set to `none` and no `kid` defined will be accepted. Note that this has serious security impact - if JWT can be sent from a third party, this allows the third party to send ANY JWT and it would be accpted as valid.
`atn-token.handler`	TokenHandler		Token handler to extract username from request.
`atn-token.jwk.resource`	Resource		JWK resource used to verify JWTs created by other parties.
`atn-token.jwt-audience`	string		Audience expected in inbound JWTs.
`atn-token.verify-signature`	boolean	`true`	Configure whether to verify signatures. Signatures verification is enabled by default. You can configure the provider not to verify signatures. Make sure your service is properly secured on network level and only accessible from a secure endpoint that provides the JWTs when signature verification is disabled. If signature verification is disabled, this service will accept ANY JWT
`authenticate`	boolean	`true`	Whether to authenticate requests.
`optional`	boolean	`false`	Whether authentication is required. By default, request will fail if the username cannot be extracted. If set to false, request will process and this provider will abstain.
`principal-type`	SubjectType (USER, SERVICE)	`USER`	Principal type this provider extracts (and also propagates).
`propagate`	boolean	`true`	Whether to propagate identity.
`sign-token`	OutboundConfig		Configuration of outbound rules.
`sign-token.jwk.resource`	Resource		JWK resource used to sign JWTs created by us.
`sign-token.jwt-issuer`	string		Issuer used to create new JWTs.
`use-jwt-groups`	boolean	`true`	Claim `groups` from JWT will be used to automatically add groups to current subject (may be used with jakarta.annotation.security.RolesAllowed annotation).