title: Spring Boot OAuth2 and Oracle IDCS: JWK Set URI responds with 401 UNAUTHORIZED, needs the token
body: <p>I am creating an <strong>OpenID/OAuth2</strong> client for <code>Oracle IDCS</code>. At first, I tested my Spring-Boot configuration with Google and GitHub, and it worked just fine. However, when I was trying to integrate with <code>Oracle IDCS</code>, I was receiving <code>401 Unauthorized</code> when the application tries to get the signing keys from JWK Set URI (<a href="https://idcs-XXXXXXXXX.identity.oraclecloud.com/admin/v1/SigningCert/jwk" rel="nofollow noreferrer">https://idcs-XXXXXXXXX.identity.oraclecloud.com/admin/v1/SigningCert/jwk</a>). I learned that Oracle IDCS JWK Set URI requires the token in the header (<code>Authorization: Bearer &lt;Access Token Value&gt;</code>). This is not the case with Google and GitHub.</p>
  
  <p><strong>application.yml</strong></p>
  
  <pre><code>spring:
    main:
      banner-mode: "console"
    jpa:
      hibernate:
        ddl-auto: "create-drop"
    security:
      oauth2:
        client:
          registration:
            oracle:
              client-id: XXXXXX
              client-secret: XXXXXX
              authorization-grant-type: authorization_code
              redirect-uri: "http://localhost:8080/login/oauth2/code/oracle"
              scope: openid
              client-name: Oracle
              provider: oracle
          provider:
            oracle:
              authorization-uri: "https://idcs-XXXXXXXXX.identity.oraclecloud.com/oauth2/v1/authorize"
              token-uri: "https://idcs-XXXXXXXXX.identity.oraclecloud.com/oauth2/v1/token"
              user-info-uri: "https://idcs-XXXXXXXXX.identity.oraclecloud.com/oauth2/v1/userinfo"
              jwk-set-uri: "https://idcs-XXXXXXXXX.identity.oraclecloud.com/admin/v1/SigningCert/jwk"
              token-info-uri: "https://idcs-XXXXXXXXX.identity.oraclecloud.com/oauth2/v1/introspect"
              user-name-attribute: name
    profiles:
      active: "@spring.profiles.active@"
  </code></pre>
  
  <p><strong>snippet from <code>org.springframework.security.oauth2.jwt.NimbusJwtDecoder</code></strong></p>
  
  <pre><code>private static class RestOperationsResourceRetriever implements ResourceRetriever {
      private static final MediaType APPLICATION_JWK_SET_JSON = new MediaType("application", "jwk-set+json");
          private final RestOperations restOperations;
  
          RestOperationsResourceRetriever(RestOperations restOperations) {
              Assert.notNull(restOperations, "restOperations cannot be null");
              this.restOperations = restOperations;
          }
  
          @Override
          public Resource retrieveResource(URL url) throws IOException {
              HttpHeaders headers = new HttpHeaders();
              headers.setAccept(Arrays.asList(MediaType.APPLICATION_JSON, APPLICATION_JWK_SET_JSON));
  
              ResponseEntity&lt;String&gt; response;
              try {
                  RequestEntity&lt;Void&gt; request = new RequestEntity&lt;&gt;(headers, HttpMethod.GET, url.toURI());
                  response = this.restOperations.exchange(request, String.class);
              } catch (Exception ex) {
                  throw new IOException(ex);
              }
  
              if (response.getStatusCodeValue() != 200) {
                  throw new IOException(response.toString());
              }
  
              return new Resource(response.getBody(), "UTF-8");
          }
      }
  }
  </code></pre>
  
  <p><strong>UPDATE:</strong>
  Manually sending an HTTP GET request with the token to JWK Set URI gives me the keys.</p>
  
  <p><code>curl -v -k -X GET -H "Content-Type:application/json" -H "Authorization: Bearer XXXXXXXXX" https://idcs-XXXXXXXXX.identity.oraclecloud.com/admin/v1/SigningCert/jwk</code></p>
  
  <pre><code>{
      "keys":[
          {
              "kty":"RSA",
              "x5t#S256":"XXXX",
              "e":"XXXX",
              "x5t":"XXXX",
              "kid":"SIGNING_KEY",
              "x5c":[
                  "XXXX",
                  "XXXX"
  
              ],
              "key_ops":[
                  "encrypt",
                  "verify"
  
              ],
              "alg":"RS256",
              "n":"XXXX"
  
          }
      ]
  }
  </code></pre>
  
  <p>How do I go about including the token in the HTTP GET request header to JWK Set URI?</p>
  
  <p>Is there a way in Spring Boot OAuth2 client to manually set the signing keys? The configuration detailed <a href="https://docs.spring.io/spring-security-oauth2-boot/docs/current/reference/htmlsingle/#oauth2-boot-resource-server-jwt-single-key" rel="nofollow noreferrer">here</a> does not work.</p>