title: Spring Security stateleless JWT authentication - How to get other jwt fields?
body: <p>We have a microservice architecture using JWT to authenticate between services. I'm looking to grab more fields out of the JWT easily. Currently really just the authorities are exposed directly by Spring Security.</p>
  
  <p>Example JWT that our edge service/API gateway creates to pass to downstream services (some fields are custom for our app):</p>
  
  <pre><code>{
    "projectId": "project1",
    "group": "client",
    "iss": "login.company.com",
    "aud": "company.com",
    "sub": "testguy",
    "exp": 1461074284992,
    "projectRoleId": "ADMINPAG",
    "contentAccessGroupId": "CAG1",
    "authorities": [
      "client",
      "PROJECT_ADD_USER",
      "PROJECT_ADD_CAG",
      "PROJECT_DOCUMENT_VIEW",
      "PROJECT_EDIT_CAG",
      "PROJECT_LIST_USERS",
      "PROJECT_SEARCH"
    ],
    "user_name": "test@company.com"
  }
  </code></pre>
  
  <p>It was surprisingly easy to get this working with Spring Boot:</p>
  
  <pre><code>compile("org.springframework.boot:spring-boot-starter-security:1.3.1")
  compile('org.springframework.security.oauth:spring-security-oauth2:2.0.8.RELEASE')
  compile('org.springframework.security:spring-security-jwt:1.0.3.RELEASE')
  </code></pre>
  
  <p>1) Annotate application class</p>
  
  <pre><code>@EnableResourceServer
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class MyApp {
  </code></pre>
  
  <p>2) Add property to application.yml to configure ignored paths and the JWT key:</p>
  
  <pre><code>security:
    basic:
      enabled: false
    oauth2:
      resource.jwt.keyValue: itsasecret
    ignored:
      - /
      - /swagger-ui.html
      - /webjars/**
      - /swagger-resources
      - /swagger/**
  </code></pre>
  
  <p>This results in the user being automatically logged in upon detection of the JWT. I can assert on their permissions with <code>@PreAuthorize("hasAuthority('PROJECT_SEARCH')")</code> just fine.</p>
  
  <p>The only thing left is I want to be able to grab other fields from the JWT (such as the "sub" - user id). This info seems to be stored in the OAuth2AccessToken#getAdditionalInformation() field. A custom UserDetails implementation would work fine here, but I'd want to be able to create the UserDetails from the JWT directly, not via a UserDetailsService (which creates one based on username).</p>
  
  <p>My primary goal with this is to be able to reference some of these JWT fields from a PreAuthorize annotation, to assert that the current user's ID is the same one passed in the "userId" argument, for example. If at all possible I'd love it if the config changes that are required for this can be isolated to an AutoConfiguration class in a shared module, so we don't have to touch all of our services. The structure of the JWT itself is 100% flexible.</p>