Does Spring Security issuer url support service by name using a discovery-service?

I have a authorization server running and is registered on my eureka discovery service with name authorization-server. For one of my microservice I am using that authorization-server name for spring-security as follows:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://authorization-server

When I make a call to this microservice that has the above config I get this error when I send in a jwt claim:

Caused by: java.net.UnknownHostException: Failed to resolve 'authorization-server' [A(1), AAAA(28)] after 12 queries 

It seems like I can't use a discoverable service name for the issuer url. Is that right or am I not using a correct convention?

The answer to "Does Spring Security issuer url support service by name using a discovery-service?" is "probably not": if present, the issuer-uri is used for two things:

• add an issuer validator to the JwtDecoder. This validator Will require access tokens iss claim to be exactly what you define in your conf (even trailing slash, if any, is important)
• if jwk-set-uri property is missing, try to fetch OpenID configuration (at URIs like {issuer-uri}/.well-known/openid-configuration) and then the JWK-set from the endpoint it finds in this conf.

So, unless the authorization server uses its name in the discovery service to set the iss claim in the access tokens it emits, you can't use this name as issuer-uri in Spring Boot configuration.

Given your current conf (no jwk-set-uri), using the "public" name for the authorization-server should solve your problem. You'll find this URI in any access token (https://jwt.io can help you read an access token payload).

But there are actually three options:

• you are not interested in the issuer validation, then omit the issuer-uri property and define just the jwk-set-uri
• you want the issuer validation and the resource server can reach the Authorization server using the URI in iss claim of access-tokens, then use that URI for setting issuer-uri in your conf (and, if your authorisation server is OIDC, omit jwk-set-uri in your conf, it will be automatically resolved)
• you want the issuer validation but the resource server can not reach the Authorization server using the URI in iss claim of access-tokens, then use that URI anyway for setting issuer-uri in your conf and set the jwk-set-uri

When set (the last two cases) the hostname used in jwk-set-uri is resolved on the resource server and must be accessible from there to fetch the tokens public signing key.