title: JWT for Resetting password with mfa
body: <p>I'm working on <code>authorization-server</code> and identity management project. Part of it is to secure the <code>reset-password</code> endpoint with MFA. </p>
  
  <ol>
  <li>The MFA logic exists in the <code>authorization-server</code> project,</li>
  <li>However, the <code>reset-password</code> itself is in the identity management project</li>
  </ol>
  
  <p>I thought that after the user completes MFA, there are two ways for the endpoint to validate that the user has privilege to reset the password:</p>
  
  <ul>
  <li>Add a ROLE_PASSWORD_RESET in the authorities role the when the <code>reset-password</code> endpoint gets called I can check the database and if the role exists I would reset the password</li>
  <li><p>Second way is to create a JWT that expires after short time. Then the front end would pass this JWT to password rest endpoint which decodes the JWT and reset password if the JWT is valid.
  Decoded JWT looks like this</p>
  
  <pre><code>{
    "exp": 1540811250,
    "user_name": "blah",
    "authorities": [
      "ROLE_PASSWORD_RESET"
    ],
    "jti": "fdbb528a-39b4-46f7-a336-79b5caa7439f",
    "client_id": "04a14e01-f303-41ca-8a7f-aa62e38a8261"
  }
  </code></pre></li>
  </ul>
  
  <p>And this is the code that produces the JWT at the end of MFA process</p>
  
  <pre><code>    if (authentication instanceof AnonymousAuthenticationToken) {
          final String username = mfaVerificationRequest.getUsername();
          final Collection &lt;GrantedAuthority&gt; authorities = AuthorityUtils.createAuthorityList(ROLE_PASSWORD_RESET);
          final Authentication authenticationToken = new UsernamePasswordAuthenticationToken(username, null, authorities);
          final String clientId = request.getParameter(OAuth2Utils.CLIENT_ID);
          final ClientDetails clientDetails = clientDetailsService.loadClientByClientId(clientId);
          final OAuth2Request auth2Request = new OAuth2Request(null, clientDetails.getClientId(), authorities, true, clientDetails.getScope(), null, null, null, null);
          final OAuth2Authentication oAuth2Authentication = new OAuth2Authentication(auth2Request, authenticationToken);
                DefaultOAuth2AccessToken.valueOf(createOauth2AccessTokenMap(clientDetails.getScope()));
          final OAuth2AccessToken enhancedAuth2AccessToken = jwtAccessTokenConverter.enhance(accessToken, oAuth2Authentication);
          response.setStatus(SC_OK);
          response.setContentType(MediaType.APPLICATION_JSON);
          response.setCharacterEncoding(StandardCharsets.UTF_8.name());
          mapper.writeValue(response.getWriter(), enhancedAuth2AccessToken);
          return;
      }
  </code></pre>
  
  <p>I believe the second approach is a hacky one because:</p>
  
  <p>Tokens (from what I understand) are meant for authenticated users <strong>but</strong> when the user is trying to reset the password, there are not authenticated user in the security context of <code>authorization-server</code></p>
  
  <ul>
  <li>Am I twisting spring security to do something it was not meant to do?</li>
  <li>Any advice on a cleaner way?</li>
  </ul>