expertKeycloak, Spring Authorization Server & Microservices Security

Why doesn't a JWT token customizer (like jwtTokenCustomizer()) affect opaque tokens?

A JWT customizer runs only during the process of ENCODING a JWT at the Authorization Server — it has no relevance to opaque tokens, which are just random reference strings with no embedded, customizable claims at all. Any role/claim information for opaque tokens must instead be derived from the introspection endpoint's response structure on the resource-server side, which is a different data shape entirely.

This is a Pro chapter

Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.

Why doesn't a JWT token customizer (like jwtTokenCustomizer()) affect opaque tokens?

Next Step

Continue to What is the key advantage of building your own Authorization Server with Spring Authorization Server versus adopting Keycloak?← Back to all Spring Security questions