title: spring-security-oauth2 JwkTokenStore with custom user details service
body: <p>I've a rich web (react based) front end application that sends request to a backend ResourceServer application. The requests are sent with JWT in the header for authentication. My setup does authentication against an Okta Authorization Server and retrieves Groups/Authorities from a separate service.</p>
  
  <p>I have the backend server setup as a Springboot app with Spring Security Oauth2 resource server <code>@EnableResourceServer</code> </p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  public class SecurityConfig extends ResourceServerConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity http) throws Exception{
          http.requestMatchers().antMatchers("/api/**")
                  .and()
                  .authorizeRequests().anyRequest().authenticated();
      }
  
      @Override
      public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
          resources.tokenServices(tokenServices()).resourceId("my-okta-resource-server-client-id");
      }
  
      @Bean
      @Primary
      public DefaultTokenServices tokenServices() throws Exception {
          DefaultTokenServices tokenServices = new DefaultTokenServices();
          tokenServices.setTokenStore(tokenStore());
          return tokenServices;
      }
  
      @Bean
      public TokenStore tokenStore() throws Exception {
         return new JwkTokenStore("https://my-org.oktapreview.com/oauth2/my-auth-server/v1/keys");
      }
  </code></pre>
  
  <p>With this setup I'm able to validate the <code>JWT</code> token alright using the <code>JwkTokenStore</code> implementation (It internally uses <code>JwkVerifyingJwtAccessTokenConverter</code> to verify the Json Web Keyset from the keys uri supplied). However I'm unable to configure it to either</p>
  
  <ol>
  <li>Pull out specific JWT claims for it to create the <code>Authentication</code>. It only looks at the user_name claim, I'd like to use email or other claims on there.</li>
  <li>Inject a custom User Details service. The <code>DefaultUserAuthenticationConverter</code> which encapsulates a <code>UserDetailsService</code> is embedded deep within. This I need to lookup authorities the user is setup with in a separate rest service. </li>
  </ol>
  
  <p>Spring-security-oauth2's JWK related implementation seems closed with most of the <code>JWKs</code> verification related classes not being public.
  What's a good way to utilize the token verification provided by <code>JwkTokenStore</code> and also be able to have your own user details in there to load authorities.</p>
  
  <p>Software versions in use:
  Springboot 1.5.2.RELEASE, spring-security-core:4.2.3, spring-security-oauth2:2.0.14, </p>