Securing Open Liberty apps and microservices with MicroProfile JWT and Social Media login

@WebServlet("/")
@ServletSecurity(value = @HttpConstraint(rolesAllowed= {"users"}))
public class MyServlet extends HttpServlet {

    public MyServlet() {
        super();
    }

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        PrintWriter pw = response.getWriter();
        Principal principal = request.getUserPrincipal();
        String jwt = null;
        if (principal != null && principal.getName() != null) {
            try {
                jwt = buildJwt(principal.getName());  // build our own JWT to propagate downstream
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        javax.ws.rs.client.ClientBuilder cb = ClientBuilder.newBuilder();
        pw.append("Calling the jaxrs service and sending jwt...\n");
        javax.ws.rs.client.Client c = cb.build();
        String res = null;
        try {
            res = c.target("https://localhost:39443/jaxrshello")
            .path("/hello").request().header("Authorization", "Bearer " + jwt)
            .get(String.class);
        } catch (Exception e) {
            res = "[Error]:" + e.toString();
        } finally {
            c.close();
        }
        pw.append("The jaxrs service response is: "+ res);
        pw.append("\n");
        pw.flush();

    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        doGet(request, response);
    }

    // use jwt-1.0 feature to build jwt
    private String buildJwt(String userName) throws Exception {
        JwtBuilder builder = JwtBuilder.create("myBuilder")
                .jwtId(true)
                .claim(Claims.SUBJECT, userName)
                .claim("upn", userName)
                .claim("groups","users");

        return builder.buildJwt().compact();
    }
}

@ApplicationPath("/")
public class JaxrsHelloApp extends Application {}

@RolesAllowed("users")  // <=== A JWT group can be specified here, or a JEE security role.
@Path("/hello")
public class HelloService {
    @Context
    HttpServletRequest request;

    @GET
    public String hello() {
      DateFormat dateFormat = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");
      Date date = new Date();
      String principalName = request.getUserPrincipal() == null ?  "null" : request.getUserPrincipal().getName();
      return "Jax-Rs app is accessed.  The current time is: "+ dateFormat.format(date)
         + " and the authenticated user is: "+ principalName;
    }
}

<server description="oidc_client">
    <featureManager>
        <feature>jaxrs-2.1</feature>
        <feature>localConnector-1.0</feature>
        <feature>appSecurity-2.0</feature>
        <feature>socialLogin-1.0</feature>
        <feature>jwt-1.0</feature>
    </featureManager>

    <httpEndpoint host="*" httpPort="19080" httpsPort="19443" id="defaultHttpEndpoint"/>

    <keyStore id="defaultKeyStore" password="keyspass"/>

    <!-- add your client ID and secret from Google -->
    <googleLogin clientId="your_client_id_from_Google_goes_here"
        clientSecret="your_client_secret_from_Google_goes_here"/>

    <jwtBuilder expiresInSeconds="600" id="myBuilder" issuer="https://example.com" keyAlias="default"/>

    <webApplication id="myservlet" location="myservlet.war" name="myservlet" type="war">
        <application-bnd>
            <security-role name="users">
                <special-subject type="ALL_AUTHENTICATED_USERS"/>
            </security-role>
        </application-bnd>
    </webApplication>

    <applicationManager autoExpand="true"/>
    <applicationMonitor updateTrigger="mbean"/>
</server>

<server description="microservice">

    <featureManager>
        <feature>transportSecurity-1.0</feature>
        <feature>jaxrs-2.1</feature>
        <feature>localConnector-1.0</feature>
        <feature>mpjwt-1.1</feature>
    </featureManager>

    <!-- configure mpjwt feature to trust jwts from oidc client -->
    <mpJwt id="mympjwt" issuer="https://example.com"
        jwksUri="https://localhost:19443/jwt/ibm/api/myBuilder/jwk"/>

    <keyStore id="defaultKeyStore" password="keyspass"/>

    <httpEndpoint httpPort="39080" httpsPort="39443" id="defaultHttpEndpoint"/>

    <applicationMonitor updateTrigger="mbean"/>
    <applicationManager autoExpand="true"/>

    <webApplication id="jaxrshello" location="jaxrshello.war" name="jaxrshello"/>
</server>