OAuth2 Resource Server Configuration in Spring Security
Fast recall
Quick revision
Core answer
.well-known/openid-configuration), and `.oauth2ResourceServer(o -> o.jwt())` in the SecurityFilterChain. Spring handles signature verification, iss/exp validation, key rotation, and JwtAuthenticationToken creation automatically. The most common customization is a `JwtAuthenticationConverter` to map a roles claim to ROLE_* authorities (default maps scope to SCOPE_*).Whether the candidate can wire a real-world OAuth2 protected API — not just understand the concept.
Manually parsing JWTs in a custom filter when Spring Security's built-in Resource Server does it automatically and more securely.
Discuss custom JWT claim to GrantedAuthority conversion, JWT decoder customization, opaque token introspection, and multi-tenancy (multiple issuers).
Interview-ready guide
Interview answer
Minimal setup
spring-boot-starter-oauth2-resource-serverspring.security.oauth2.resourceserver.jwt.issuer-uri: https://auth.example.com.oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))in SecurityFilterChain- Spring fetches JWKS from
.well-known/openid-configuration - Validates
Authorization: Beareragainst fetched public keys - Claims mapped to
JwtAuthenticationTokenin SecurityContext
Claim-to-authority mapping
- Default:
scope->SCOPE_read,SCOPE_write - Custom:
@Bean JwtAuthenticationConverterwithsetAuthoritiesClaimName("roles")andsetAuthorityPrefix("ROLE_") @PreAuthorize("hasAuthority('SCOPE_read')")orhasRole('ADMIN')— depends on mapping
Additional claim validation
JwtClaimValidator- Compose with
DelegatingOAuth2TokenValidator - Failure -> 401 with
WWW-Authenticate: Bearer error="invalid_token"
Opaque tokens
opaquetoken.introspection-uriinstead ofjwt.issuer-uri- Per-request introspection; cache 30-60s
- Pro: instant revocation; Con: network call per request
Multi-tenancy
JwtIssuerAuthenticationManagerResolver.fromTrustedIssuers(...)- Allowlist of trusted issuers
- Each gets its own decoder and JWKS
Why not write a custom filter
- Spring handles JWKS rotation, algorithm pinning, clock skew, expiry, issuer
- Custom code routinely misses algorithm confusion, audience validation, key rotation
OAuth2 Resource Server Configuration in Spring Security
Direct Answer
A Resource Server validates JWT Bearer tokens to protect API endpoints. Spring Security's built-in support needs spring-boot-starter-oauth2-resource-server, the issuer-uri property (so Spring can fetch the JWKS public keys from .well-known/openid-configuration), and .oauth2ResourceServer(o -> o.jwt()) in the SecurityFilterChain. Spring handles signature verification, iss/exp validation, key rotation, and JwtAuthenticationToken creation automatically. The most common customization is a JwtAuthenticationConverter to map a roles claim to ROLE_* authorities (default maps scope to SCOPE_*).
Common Mistakes & Pitfalls
Manually parsing JWTs in a custom filter when Spring Security's built-in Resource Server does it automatically and more securely.
Check your understanding
Answer these without looking back at the article.
- How would you validate additional JWT claims like 'aud' (audience) or a custom claim?
- How do you configure a Resource Server to accept tokens from multiple issuers (multi-tenancy)?
- What is the difference between JWT-based and opaque token Resource Server configuration?
- How does Spring handle JWKS key rotation automatically?
Related interview prep categories
2Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.