feat: add jwtDecoder to McpServerOAuth2Configurer

[stdevi]

Changes in this PR

Adding jwtDecoder to the McpServerOAuth2Configurer to set NimbusJwtDecoder.

[Kehrlann]

@stdevi thanks for contributing.

Before going further, what are you trying to accomplish with this exactly exactly?

[stdevi]

@stdevi thanks for contributing.

Before going further, what are you trying to accomplish with this exactly exactly?

I have a project where I would like to use custom rest operations for the resource server. However, this implementation does not allow configuring it. I was hoping to expose jwtDecoderCustomizer to achieve that.

[Kehrlann]

Let’s inject a full JwtDecoder instead of an customizer.

[stdevi]

@Kehrlann should I use NimbusJwtDecoder or rather JwtDecoder interface? If we use JwtDecoder, then the validateAudienceClaim won't be enforced.

[Kehrlann]

ValidateAudienceClaim is a good point.
I'm away this week, let me pick this back up next week.

[Kehrlann]

Sorry for the delay here. So, I think we should go with JwtDecoder.

I don't want to remove the validateAudienceClaim, and I don't want it to be a "no-op" when you have a raw JwtDecoder.
So let's do the following:

1. If jwtDecoder is null, keep the code as is.
2. If jwtDecoder != null && validateAudienceClaim == false, use the raw jwtDecoder
3. If jwtDecoder != null && validateAudienceClaim == true, wrap the jwtDecoder into a "audience validation jwt decoder", that does something similar to the NimubsJwtDecoder#validateJwt (only handle a single error). This wrapper decoder would be a simple lambda.

What do you think?

It'd be nice to add a test for this configurer, but it does require a bit of infrastructure (because we don't want to pull Boot in here). If you're interested in submitting a subsequent PR with such a test, please let met know.