Hi Andrej,

as Jack points out, the best way to do this is registering your own AuthVerifier to process and validate the incoming JWT token.

There are a lot of different ways to process a JWT token and they can bear a lot of different information, not to mention encryption or signatures, that's the main reason you need to register a customization for this.

We are tracking this proposed standard in our backlog to provide a more standard way of processing JWT in the future. Although it is possible that still some customizations would need to be applied we should expect a more straightforward integration with the OAuth2 layer.

Hope this helps.

Carlos.

Hi Andrej,

I've achieved what you're looking at. You can check a sample project over here: https://github.com/fabian-bouche-liferay/external-oauth

I've also talked to Carlos and I agree that RFC 8693 would be an easier solution to address this same requirement.

Whatever the path, bear in mind that the biggest effort when dealing with maintenance is going to keep the scopes synchronized between Liferay and your authorization server to manage the permissions given to clients on the liferay headless CMS objects.

If you were to use my current solution, please get back to me if you have any feedback. I'm not using in a real project yet.

Kind regards,

Fabian