Merge branch '7.0.x'

docs/modules/ROOT/pages/migration/servlet/oauth2.adoc

@@ -132,4 +132,11 @@ authenticationConverter.setBearerTokenResolver(myBearerTokenResolver)
 authenticationConverter.setAuthenticationDetailsSource(myAuthenticationDetailsSource)
 val filter = BearerTokenAuthenticationFilter(authenticationManager, authenticationConverter)
 ----
+
+== `NimbusJwtDecoder`'s Default Connect and Read Timeouts Are Now 30 Seconds
+
+`NimbusJwtDecoder`'s default `RestOperations`, used to fetch a JWK Set when no `RestOperations` is otherwise configured, previously used a 500 millisecond connect and read timeout.
+This value was too short for many deployments and is now 30 seconds, aligning with the connect and read timeouts already used elsewhere in the OAuth2 Client and Resource Server support, such as xref:servlet/oauth2/client/index.adoc[`ClientRegistrations`].
+
+If your application relies on the previous, shorter timeout -- for example, expecting a fast failure when the authorization server is unreachable -- you can restore it either by setting the JDK's `sun.net.client.defaultConnectTimeout` and `sun.net.client.defaultReadTimeout` system properties (in milliseconds), or by providing your own `RestOperations`, as described in xref:servlet/oauth2/resource-server/jwt.adoc#oauth2resourceserver-jwt-timeouts[Configuring Timeouts].
 ======

docs/modules/ROOT/pages/servlet/oauth2/login/advanced.adoc

@@ -944,5 +944,52 @@ For MAC-based algorithms (such as `HS256`, `HS384`, or `HS512`), the `client-sec
 If more than one `ClientRegistration` is configured for OpenID Connect 1.0 Authentication, the JWS algorithm resolver may evaluate the provided `ClientRegistration` to determine which algorithm to return.
 ====
 
+[[oauth2login-advanced-idtoken-decoder-factory]]
+== Providing a Custom JwtDecoderFactory
+
+`OidcIdTokenDecoderFactory` is deliberately narrow: it exists to make it easy to support multiple `ClientRegistration` instances, each potentially needing a different `JwtDecoder`, and its configuration surface is limited to what most applications need for that purpose, such as the JWS algorithm resolver shown above.
+
+If your application needs deeper control over how the ID Token's `JwtDecoder` is constructed -- for example, providing your own `RestOperations` -- you can instead provide your own `JwtDecoderFactory<ClientRegistration>` `@Bean`.
+Because OAuth2 Login does not use a resource server `JwtDecoder` bean for this purpose, this is the supported way to reach the same level of control that `NimbusJwtDecoder`'s builder already offers, without introducing additional configuration properties on `OidcIdTokenDecoderFactory` itself.
+
+For a single `ClientRegistration`, this can be as simple as:
+
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Bean
+JwtDecoderFactory<ClientRegistration> idTokenDecoderFactory(RestOperations rest) {
+	return (clientRegistration) -> {
+		String issuerUri = clientRegistration.getProviderDetails().getIssuerUri();
+		NimbusJwtDecoder decoder = NimbusJwtDecoder.withIssuerLocation(issuerUri).restOperations(rest).build();
+		decoder.setJwtValidator(JwtValidators.createDefaultWithValidators(new OidcIdTokenValidator(clientRegistration)));
+		decoder.setClaimTypeConverter(OidcIdTokenDecoderFactory.createDefaultClaimTypeConverter());
+		return decoder;
+	};
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun idTokenDecoderFactory(rest: RestOperations): JwtDecoderFactory<ClientRegistration> {
+    return JwtDecoderFactory { clientRegistration ->
+        val issuerUri = clientRegistration.providerDetails.issuerUri
+        val decoder = NimbusJwtDecoder.withIssuerLocation(issuerUri).restOperations(rest).build()
+        decoder.setJwtValidator(JwtValidators.createDefaultWithValidators(OidcIdTokenValidator(clientRegistration)))
+        decoder.setClaimTypeConverter(OidcIdTokenDecoderFactory.createDefaultClaimTypeConverter())
+        decoder
+    }
+}
+----
+======
+
+If you have multiple `ClientRegistration` instances and want to avoid rebuilding a `JwtDecoder` on every request, cache the decoder per registration, for example by annotating the factory method with `@Cacheable` or by keying a `Map` on `ClientRegistration#getRegistrationId()`.
+
 [[oauth2login-advanced-oidc-logout]]
 Then, you can proceed to configure xref:servlet/oauth2/login/logout.adoc[logout]

docs/modules/ROOT/pages/servlet/oauth2/resource-server/jwt.adoc

@@ -1622,6 +1622,7 @@ fun jwtDecoder(): JwtDecoder {
 == Configuring Timeouts
 
 By default, Resource Server uses connection and socket timeouts of 30 seconds each for coordinating with the authorization server.
+You can override these defaults without changing any code by setting the JDK's `sun.net.client.defaultConnectTimeout` and `sun.net.client.defaultReadTimeout` system properties (in milliseconds).
 
 This may be too short in some scenarios.
 Further, it doesn't take into account more sophisticated patterns like back-off and discovery.