I have the following…

我有以下…

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.oauth2Login(AbstractHttpConfigurer::disable)
                .oauth2ResourceServer(AbstractHttpConfigurer::disable)
                .sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests((authz) -> authz
                        .requestMatchers(
                                new AntPathRequestMatcher("/actuator/**")
                        ).hasAuthority("SCOPE_read:actuators")
                        .anyRequest().authenticated()
                );
        return http.build();
    }
    @Bean
    JwtDecoder jwtDecoder(OAuth2ResourceServerProperties properties, @Value("${auth0.audience}") String audience) {
        /*
         * By default, Spring Security does not validate the "aud" claim of the token,
         * to ensure that this token is
         * indeed intended for our app. Adding our own validator is easy to do:
         */

        String issuerUri = properties.getJwt().getIssuerUri();
        NimbusJwtDecoder jwtDecoder = JwtDecoders.fromOidcIssuerLocation(issuerUri);

        OAuth2TokenValidator<Jwt> audienceValidator = AudienceValidator.of(audience);
        OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuerUri);
        OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);

        jwtDecoder.setJwtValidator(withAudience);

        return jwtDecoder;
    }

And the following config…

和以下配置…

auth0:
  audience: ...
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: ...

I am trying to call the endpoint with curl http://localhost:8080/actuator -v -H "Authorization: Bearer ..." and curl http://localhost:8080/actuator -v -H "Authorization: OAuth ..."

我正在尝试使用CURL http://localhost:8080/actuator-v-H呼叫终结点“授权：承载...”和CURL http://localhost:8080/actuator-v-H“授权：OAUTH...”

I have confirmed the access token has

我已确认访问令牌已

{
  "iss": "...",
  "sub": "...",
  "aud": [
    "...",
    "..."
  ],
  "iat": ...,
  "exp": ...,
  "azp": "...",
  "scope": "openid profile email",
  "permissions": [
    "read:actuators"
  ]
}

The aud and iss match but when I go to the site I get a 403. If I make it permit-all then it works fine.

澳元和国际空间站是匹配的，但当我去现场时，我得到了403分。如果我允许这样做，那么它就能正常工作。

What am I missing here?

我错过了什么吗？

I also tried to add this but the same issue...

我也想加上这一点，但同样的问题...

.oauth2ResourceServer((oauth2) -> oauth2
                        .jwt((jwt) ->jwt.decoder(jwtDecoder()))
                )

The bean it was missing (Just for Auth0) is this

它缺少的Bean(仅用于Auth0)如下所示

    @Bean
    public JwtAuthenticationConverter jwtAuthenticationConverter() {
        JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
        grantedAuthoritiesConverter.setAuthoritiesClaimName("permissions");

        JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
        jwtAuthenticationConverter.setJwtGrantedAuthoritiesConverter(grantedAuthoritiesConverter);
        return jwtAuthenticationConverter;
    }

The permission can be extracted to a application property if your provider uses something else but for auth0 it will always be permissions.

如果您的提供程序使用其他内容，则可以将权限提取到应用程序属性，但对于auth0，它将始终是权限。

More information can be found in the official Spring Security site here

有关更多信息，请访问官方的Spring Security站点

You have to enable resource server configuration for access token to be used when building the security context.

您必须启用资源服务器配置，以便在构建安全上下文时使用访问令牌。

You also need a Converter<Jwt, ? extends AbstractAuthenticationToken> to convert the content of a private claim into Spring authorities. JwtAuthenticationConverter is the default implementation for this interface and configurable to some extent (will work if you want to use only one claim directly under root node, which seems to be your case for now). Just expose a bean of that type with overriden configuration to read the permissions claim.

您还需要转换器 以将私有声明的内容转换为Spring授权。JwtAuthenticationConverter是该接口的默认实现，并且在某种程度上是可配置的(如果您只想在根节点下直接使用一个声明，那么就可以使用，这似乎是您目前的情况)。只需使用覆盖配置公开该类型的Bean即可读取权限声明。

You can find samples in my tutorials, all work with Auth0 (as well as Keycloak, and Amazon Cognito).

您可以在我的教程中找到样例，它们都使用Auth0(以及Keyloak和Amazon Cognito)。