generator-jhipster 7.7.0 → 7.9.0

package/generators/server/templates/src/main/docker/keycloak.yml.ejs

@@ -21,16 +21,18 @@ version: '<%= DOCKER_COMPOSE_FORMAT_VERSION %>'
 services:
   keycloak:
     image: <%= DOCKER_KEYCLOAK %>
-    command: ["-b", "0.0.0.0", "-Dkeycloak.migration.action=import", "-Dkeycloak.migration.provider=dir", "-Dkeycloak.migration.dir=/opt/jboss/keycloak/realm-config", "-Dkeycloak.migration.strategy=OVERWRITE_EXISTING", "-Djboss.socket.binding.port-offset=1000", "-Dkeycloak.profile.feature.upload_scripts=enabled"]
+    command: ['start-dev --import-realm']
     volumes:
-      - ./realm-config:/opt/jboss/keycloak/realm-config
+      - ./realm-config:/opt/keycloak/data/import
     environment:
-      - KEYCLOAK_USER=admin
-      - KEYCLOAK_PASSWORD=admin
-      - DB_VENDOR=h2
+      - KC_DB=dev-file
+      - KEYCLOAK_ADMIN=admin
+      - KEYCLOAK_ADMIN_PASSWORD=admin
+      - KC_FEATURES=scripts
+      - KC_HTTP_PORT=9080
+      - KC_HTTPS_PORT=9443
     # If you want to expose these ports outside your dev PC,
     # remove the "127.0.0.1:" prefix
     ports:
       - 127.0.0.1:9080:9080
       - 127.0.0.1:9443:9443
-      - 127.0.0.1:10990:10990

package/generators/server/templates/src/main/java/package/config/ApplicationProperties.java.ejs

@@ -28,4 +28,7 @@ import org.springframework.boot.context.properties.ConfigurationProperties;
  */
 @ConfigurationProperties(prefix = "application", ignoreUnknownFields = false)
 public class ApplicationProperties {
+    // jhipster-needle-application-properties-property
+    // jhipster-needle-application-properties-property-getter
+    // jhipster-needle-application-properties-property-class
 }

package/generators/server/templates/src/main/java/package/config/AsyncConfiguration.java.ejs

@@ -26,6 +26,7 @@ import org.springframework.aop.interceptor.SimpleAsyncUncaughtExceptionHandler;
 import org.springframework.boot.autoconfigure.task.TaskExecutionProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Profile;
 import org.springframework.scheduling.annotation.AsyncConfigurer;
 import org.springframework.scheduling.annotation.EnableAsync;
 import org.springframework.scheduling.annotation.EnableScheduling;
@@ -36,6 +37,7 @@ import java.util.concurrent.Executor;
 @Configuration
 @EnableAsync
 @EnableScheduling
+@Profile("!testdev & !testprod")
 public class AsyncConfiguration implements AsyncConfigurer {
 
     private final Logger log = LoggerFactory.getLogger(AsyncConfiguration.class);

package/generators/server/templates/src/main/java/package/config/DatabaseConfiguration_couchbase.java.ejs

@@ -179,7 +179,7 @@ public class DatabaseConfiguration extends AbstractCouchbaseConfiguration {
     @Bean
     @Profile({JHipsterConstants.SPRING_PROFILE_TEST, JHipsterConstants.SPRING_PROFILE_E2E})
     public Couchmove waitForIndexes(Couchmove couchmove) {
-        couchmove.waitForN1qlIndexes(getScopeName(), Duration.ofSeconds(60));
+        couchmove.waitForN1qlIndexes(getScopeName(), Duration.ofMinutes(15));
         return couchmove;
     }
 

package/generators/{client/templates/react/src/main/webapp/app/entities/index.tsx.ejs → server/templates/src/main/java/package/config/KafkaSseConsumer.java.ejs}

@@ -16,21 +16,15 @@
  See the License for the specific language governing permissions and
  limitations under the License.
 -%>
-import React from 'react';
-import { Switch } from 'react-router-dom';
+package <%= packageName %>.config;
 
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-import ErrorBoundaryRoute from 'app/shared/error/error-boundary-route';
+import org.springframework.cloud.stream.annotation.Input;
+import org.springframework.messaging.MessageChannel;
 
-/* jhipster-needle-add-route-import - JHipster will add routes here */
+public interface KafkaSseConsumer {
 
-const Routes = ({ match }) => (
-  <div>
-    <Switch>
-      {/* prettier-ignore */}
-      {/* jhipster-needle-add-route-path - JHipster will add routes here */}
-    </Switch>
-  </div>
-);
+    String CHANNELNAME = "binding-in-sse";
 
-export default Routes;
+    @Input(CHANNELNAME)
+    MessageChannel input();
+}

package/generators/server/templates/src/main/java/package/config/KafkaSseProducer.java.ejs

@@ -0,0 +1,30 @@
+<%#
+ Copyright 2013-2022 the original author or authors from the JHipster project.
+
+ This file is part of the JHipster project, see https://www.jhipster.tech/
+ for more information.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+      https://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-%>
+package <%= packageName %>.config;
+
+import org.springframework.cloud.stream.annotation.Output;
+import org.springframework.messaging.MessageChannel;
+
+public interface KafkaSseProducer {
+
+    String CHANNELNAME = "binding-out-sse";
+
+    @Output(CHANNELNAME)
+    MessageChannel output();
+}

package/generators/server/templates/src/main/java/package/config/SecurityConfiguration.java.ejs

@@ -45,7 +45,7 @@ import org.springframework.security.config.annotation.web.builders.WebSecurity;
   <%_ } _%>
 <%_ } _%>
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 <%_ if (authenticationTypeJwt || (authenticationTypeOauth2 && applicationTypeMicroservice)) { _%>
 import org.springframework.security.config.http.SessionCreationPolicy;
 <%_ } _%>
@@ -100,7 +100,7 @@ import org.zalando.problem.spring.web.advice.security.SecurityProblemSupport;
 @EnableWebSecurity
 @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
 @Import(SecurityProblemSupport.class)
-public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
+public class SecurityConfiguration {
 
     private final JHipsterProperties jHipsterProperties;
 <%_ if (authenticationTypeSession && !skipUserManagement) { _%>
@@ -159,35 +159,9 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
         return new BCryptPasswordEncoder();
     }
 <%_ } _%>
-<%_ if (!applicationTypeMicroservice) { _%>
 
-    @Override
-    public void configure(WebSecurity web) {
-        web.ignoring()
-            .antMatchers(HttpMethod.OPTIONS, "/**")
-  <%_ if (!skipClient) { _%>
-            .antMatchers("/app/**/*.{js,html}")
-            .antMatchers("/i18n/**")
-            .antMatchers("/content/**")
-  <%_ } _%>
-  <%_ if (devDatabaseTypeH2Any) { _%>
-            .antMatchers("/h2-console/**")
-  <%_ } _%>
-            .antMatchers("/swagger-ui/**")
-            .antMatchers("/test/**");
-    }
-<%_ } else { _%>
-  <%_ if (devDatabaseTypeH2Any) { _%>
-    @Override
-    public void configure(WebSecurity web) {
-        web.ignoring()
-            .antMatchers("/h2-console/**");
-    }
-  <%_ } _%>
-<%_ } _%>
-
-    @Override
-    public void configure(HttpSecurity http) throws Exception {
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         // @formatter:off
         http
             .csrf()
@@ -236,7 +210,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
             .permissionsPolicy().policy("camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=()")
         .and()
             .frameOptions()
-            .deny()
+            .sameOrigin()
         .and()
 <%_ if (authenticationTypeJwt || (authenticationTypeOauth2 && applicationTypeMicroservice)) { _%>
             .sessionManagement()
@@ -244,6 +218,19 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
         .and()
 <%_ } _%>
             .authorizeRequests()
+<%_ if (!applicationTypeMicroservice) { _%>
+            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
+  <%_ if (!skipClient) { _%>
+            .antMatchers("/app/**/*.{js,html}").permitAll()
+            .antMatchers("/i18n/**").permitAll()
+            .antMatchers("/content/**").permitAll()
+  <%_ } _%>
+            .antMatchers("/swagger-ui/**").permitAll()
+            .antMatchers("/test/**").permitAll()
+<%_ } _%>
+<%_ if (devDatabaseTypeH2Any) { _%>
+            .antMatchers("/h2-console/**").permitAll()
+<%_ } _%>
             .antMatchers("/api/authenticate").permitAll()
 <%_ if (!authenticationTypeOauth2 && !skipUserManagement) { _%>
             .antMatchers("/api/register").permitAll()
@@ -284,6 +271,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
             .and()
                 .oauth2Client();
 <%_ } _%>
+        return http.build();
         // @formatter:on
     }
 <%_ if (authenticationTypeJwt) { _%>
@@ -325,7 +313,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
   <%_ } _%>
 
     @Bean
-    JwtDecoder jwtDecoder(<%_ if (authenticationTypeOauth2 && applicationTypeMonolith) { _%>ClientRegistrationRepository clientRegistrationRepository, RestTemplateBuilder restTemplateBuilder<%_ } _%>) {
+    JwtDecoder jwtDecoder(<%_ if (!applicationTypeMicroservice) { _%>ClientRegistrationRepository clientRegistrationRepository, RestTemplateBuilder restTemplateBuilder<%_ } _%>) {
         NimbusJwtDecoder jwtDecoder = JwtDecoders.fromOidcIssuerLocation(issuerUri);
 
         OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator(jHipsterProperties.getSecurity().getOauth2().getAudience());
@@ -333,7 +321,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
         OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);
 
         jwtDecoder.setJwtValidator(withAudience);
-  <%_ if (authenticationTypeOauth2 && applicationTypeMonolith) { _%>
+  <%_ if (!applicationTypeMicroservice) { _%>
         jwtDecoder.setClaimSetConverter(new CustomClaimConverter(clientRegistrationRepository.findByRegistrationId("oidc"), restTemplateBuilder.build()));
   <%_ } _%>
 

package/generators/server/templates/src/main/java/package/config/SecurityConfiguration_reactive.java.ejs

@@ -47,6 +47,9 @@ import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
 <%_ if (authenticationTypeOauth2) { _%>
 import org.springframework.core.convert.converter.Converter;
+  <%_ if (!applicationTypeMicroservice) { _%>
+import org.springframework.core.ParameterizedTypeReference;
+  <%_ } _%>
 <%_ } _%>
 import org.springframework.http.HttpMethod;
 <%_ if (authenticationTypeSession) { _%>
@@ -68,17 +71,18 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcReactiveOAuth2UserService;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
-<%_ if (applicationTypeGateway) { _%>
+<%_ if (!applicationTypeMicroservice) { _%>
+import org.springframework.security.oauth2.client.registration.ClientRegistration;
 import org.springframework.security.oauth2.client.registration.ReactiveClientRegistrationRepository;
 <%_ } _%>
 import org.springframework.security.oauth2.client.userinfo.ReactiveOAuth2UserService;
-<%_ if (applicationTypeGateway) { _%>
+<%_ if (!applicationTypeMicroservice) { _%>
 import org.springframework.security.oauth2.client.web.server.DefaultServerOAuth2AuthorizationRequestResolver;
 import org.springframework.security.oauth2.client.web.server.ServerOAuth2AuthorizationRequestResolver;
 <%_ } _%>
 import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
 import org.springframework.security.oauth2.core.OAuth2TokenValidator;
-<%_ if (applicationTypeGateway) { _%>
+<%_ if (!applicationTypeMicroservice) { _%>
 import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
 <%_ } _%>
 import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
@@ -87,7 +91,6 @@ import org.springframework.security.oauth2.core.oidc.user.OidcUserAuthority;
 import org.springframework.security.oauth2.jwt.*;
 import org.springframework.security.oauth2.server.resource.authentication.ReactiveJwtAuthenticationConverterAdapter;
 import org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository;
-import org.springframework.security.web.server.header.ReferrerPolicyServerHttpHeadersWriter;
 <%_ } _%>
 <%_ if (!authenticationTypeOauth2) { _%>
   <%_ if (skipUserManagement) { _%>
@@ -122,17 +125,25 @@ import org.springframework.security.web.server.util.matcher.OrServerWebExchangeM
 <%_ if (skipUserManagement && !authenticationTypeOauth2) { _%>
 import org.springframework.util.StringUtils;
 <%_ } _%>
+import org.springframework.web.cors.reactive.CorsWebFilter;
 import org.zalando.problem.spring.webflux.advice.security.SecurityProblemSupport;
 <%_ if (authenticationTypeSession || authenticationTypeOauth2) { _%>
 import reactor.core.publisher.Mono;
 <%_ } _%>
 <%_ if (authenticationTypeOauth2) { _%>
+  <%_ if (!applicationTypeMicroservice) { _%>
+import org.springframework.web.reactive.function.client.WebClient;
+
+import java.util.Arrays;
+import java.util.Map;
+  <%_ } _%>
 
 import java.util.HashSet;
 import java.util.Set;
-<%_ if (applicationType === 'gateway') { _%>
+  <%_ if (!applicationTypeMicroservice) { _%>
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.Consumer;
-<%_ } _%>
+  <%_ } _%>
 <%_ } _%>
 
 import static org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers;
@@ -155,15 +166,20 @@ public class SecurityConfiguration {
 <%_ if (authenticationTypeOauth2) { _%>
     @Value("${spring.security.oauth2.client.provider.oidc.issuer-uri}")
     private String issuerUri;
-  <%_ if (applicationTypeGateway) { _%>
+  <%_ if (!applicationTypeMicroservice) { _%>
 
     private final ReactiveClientRegistrationRepository clientRegistrationRepository;
+
+    // todo: optimize for scale https://github.com/jhipster/generator-jhipster/issues/18868
+    private final Map<String, Mono<Jwt>> users = new ConcurrentHashMap<>();
+
   <%_ } _%>
 <%_ } _%>
     private final SecurityProblemSupport problemSupport;
+    private final CorsWebFilter corsWebFilter;
 
-    public SecurityConfiguration(<% if (!skipUserManagement && !authenticationTypeOauth2) { %>ReactiveUserDetailsService userDetailsService, <% } %><% if (authenticationTypeJwt) { %>TokenProvider tokenProvider, <% } %><% if (authenticationTypeOauth2 && applicationTypeGateway) { %> ReactiveClientRegistrationRepository clientRegistrationRepository, <% } %>JHipsterProperties jHipsterProperties, SecurityProblemSupport problemSupport) {
-<%_ if (authenticationTypeOauth2 && applicationTypeGateway) { _%>
+    public SecurityConfiguration(<% if (!skipUserManagement && !authenticationTypeOauth2) { %>ReactiveUserDetailsService userDetailsService, <% } %><% if (authenticationTypeJwt) { %>TokenProvider tokenProvider, <% } %><% if (authenticationTypeOauth2 && !applicationTypeMicroservice) { %> ReactiveClientRegistrationRepository clientRegistrationRepository, <% } %>JHipsterProperties jHipsterProperties, SecurityProblemSupport problemSupport, CorsWebFilter corsWebFilter) {
+<%_ if (authenticationTypeOauth2 && !applicationTypeMicroservice) { _%>
         this.clientRegistrationRepository = clientRegistrationRepository;
 <%_ } _%>
 <%_ if (!skipUserManagement && !authenticationTypeOauth2) { _%>
@@ -174,6 +190,7 @@ public class SecurityConfiguration {
 <%_ } _%>
         this.jHipsterProperties = jHipsterProperties;
         this.problemSupport = problemSupport;
+        this.corsWebFilter = corsWebFilter;
     }
 
 <%_ if (!skipUserManagement && !authenticationTypeOauth2) { _%>
@@ -212,7 +229,7 @@ public class SecurityConfiguration {
         // @formatter:off
         http
             .securityMatcher(new NegatedServerWebExchangeMatcher(new OrServerWebExchangeMatcher(
-                pathMatchers("/app/**", "/i18n/**", "/content/**", "/swagger-ui/**", "/v3/api-docs/**", "/test/**"),
+                pathMatchers("/app/**", "/_app/**", "/i18n/**", "/img/**", "/content/**", "/swagger-ui/**", "/v3/api-docs/**", "/test/**"),
                 pathMatchers(HttpMethod.OPTIONS, "/**")
             )))
             .csrf()
@@ -224,6 +241,7 @@ public class SecurityConfiguration {
 <%_ } else { _%>
                 .disable()
 <%_ } _%>
+            .addFilterBefore(corsWebFilter, SecurityWebFiltersOrder.REACTOR_CONTEXT)
 <%_ if (!skipClient) { _%>
             .addFilterAt(new SpaWebFilter(), SecurityWebFiltersOrder.AUTHENTICATION)
 <%_ } _%>
@@ -275,16 +293,20 @@ public class SecurityConfiguration {
             .pathMatchers("/api/account/reset-password/init").permitAll()
             .pathMatchers("/api/account/reset-password/finish").permitAll()
 <%_ } _%>
+<%_ if (authenticationTypeOauth2) { _%>
             .pathMatchers("/api/auth-info").permitAll()
+<%_ } _%>
             .pathMatchers("/api/admin/**").hasAuthority(AuthoritiesConstants.ADMIN)
             .pathMatchers("/api/**").authenticated()
 <%_ if (applicationTypeGateway) { _%>
+  <%_ if (microfrontend) { _%>
             // microfrontend resources are loaded by webpack without authentication, they need to be public
             .pathMatchers("/services/*/*.js").permitAll()
             .pathMatchers("/services/*/*.js.map").permitAll()
+  <%_ } _%>
             .pathMatchers("/services/*/v3/api-docs").hasAuthority(AuthoritiesConstants.ADMIN)
 <%_ } _%>
-<%_ if (applicationTypeMonolith || applicationTypeGateway) { _%>
+<%_ if (!applicationTypeMicroservice) { _%>
             .pathMatchers("/services/**").authenticated()
 <%_ } _%>
             .pathMatchers("/management/health").permitAll()
@@ -294,8 +316,7 @@ public class SecurityConfiguration {
             .pathMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN);
 <%_ if (authenticationTypeOauth2) { _%>
 
-        http<%_ if (applicationTypeGateway || applicationTypeMonolith) { _%><%_ if (applicationTypeGateway) { _%>.oauth2Login(oauth2 -> oauth2.authorizationRequestResolver(authorizationRequestResolver(this.clientRegistrationRepository)))<%_ } else { _%>.oauth2Login()
-            .and()<%_ } _%>
+        http<%_ if (!applicationTypeMicroservice) { _%>.oauth2Login(oauth2 -> oauth2.authorizationRequestResolver(authorizationRequestResolver(this.clientRegistrationRepository)))
             <% } %>
             .oauth2ResourceServer()
                 .jwt()
@@ -307,7 +328,7 @@ public class SecurityConfiguration {
     }
 <%_ if (authenticationTypeOauth2) { _%>
 
-  <%_ if (applicationTypeGateway) { _%>
+  <%_ if (!applicationTypeMicroservice) { _%>
     private ServerOAuth2AuthorizationRequestResolver authorizationRequestResolver(
         ReactiveClientRegistrationRepository clientRegistrationRepository) {
         DefaultServerOAuth2AuthorizationRequestResolver authorizationRequestResolver =
@@ -359,7 +380,8 @@ public class SecurityConfiguration {
     }
 
     @Bean
-    ReactiveJwtDecoder jwtDecoder() {
+    ReactiveJwtDecoder jwtDecoder(<%_ if (!applicationTypeMicroservice) { _%>ReactiveClientRegistrationRepository registrations<%_ } _%>) {
+    <%_ if (applicationTypeMicroservice) { _%>
         NimbusReactiveJwtDecoder jwtDecoder = (NimbusReactiveJwtDecoder) ReactiveJwtDecoders.fromOidcIssuerLocation(issuerUri);
 
         OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator(jHipsterProperties.getSecurity().getOauth2().getAudience());
@@ -370,7 +392,78 @@ public class SecurityConfiguration {
 
         return jwtDecoder;
     }
+    <%_ } else { _%>
+
+        Mono<ClientRegistration> clientRegistration = registrations.findByRegistrationId("oidc");
+
+        return clientRegistration.map(oidc -> createJwtDecoder(
+            oidc.getProviderDetails().getIssuerUri(),
+            oidc.getProviderDetails().getJwkSetUri(),
+            oidc.getProviderDetails().getUserInfoEndpoint().getUri()
+        )).block();
+    }
+
+    private ReactiveJwtDecoder createJwtDecoder(String issuerUri, String jwkSetUri, String userInfoUri) {
+        NimbusReactiveJwtDecoder jwtDecoder = new NimbusReactiveJwtDecoder(jwkSetUri);
+        OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator(
+            jHipsterProperties.getSecurity().getOauth2().getAudience());
+        OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuerUri);
+        OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);
+
+        jwtDecoder.setJwtValidator(withAudience);
 
+        return new ReactiveJwtDecoder() {
+            @Override
+            public Mono<Jwt> decode(String token) throws JwtException {
+                return jwtDecoder.decode(token)
+                    .flatMap(jwt -> enrich(token, jwt));
+            }
+
+            private Mono<Jwt> enrich(String token, Jwt jwt) {
+                // Only look up user information if identity claims are missing
+                if (jwt.hasClaim("given_name") && jwt.hasClaim("family_name")) {
+                    return Mono.just(jwt);
+                }
+                // Retrieve user info from OAuth provider if not already loaded
+                return users.computeIfAbsent(jwt.getSubject(), s -> {
+                    WebClient webClient = WebClient.create();
+
+                    return webClient
+                        .get()
+                        .uri(userInfoUri)
+                        .headers(headers -> headers.setBearerAuth(token))
+                        .retrieve()
+                        .bodyToMono(new ParameterizedTypeReference<Map<String, Object>>() {})
+                        .map(userInfo ->
+                            Jwt
+                                .withTokenValue(jwt.getTokenValue())
+                                .subject(jwt.getSubject())
+                                .audience(jwt.getAudience())
+                                .headers(headers -> headers.putAll(jwt.getHeaders()))
+                                .claims(claims -> {
+                                    String username = userInfo.get("preferred_username").toString();
+                                    // special handling for Auth0
+                                    if (userInfo.get("sub").toString().contains("|") && username.contains("@")) {
+                                        userInfo.put("email", username);
+                                    }
+                                    // Allow full name in a name claim - happens with Auth0
+                                    if (userInfo.get("name") != null) {
+                                        String[] name = userInfo.get("name").toString().split("\\s+");
+                                        if (name.length > 0) {
+                                            userInfo.put("given_name", name[0]);
+                                            userInfo.put("family_name", String.join(" ", Arrays.copyOfRange(name, 1, name.length)));
+                                        }
+                                    }
+                                    claims.putAll(userInfo);
+                                })
+                                .claims(claims -> claims.putAll(jwt.getClaims()))
+                                .build()
+                        );
+                });
+            }
+        };
+    }
+    <%_ } _%>
 <%_ } _%>
 <%_ if (authenticationTypeSession) { _%>
 

package/generators/server/templates/src/main/java/package/config/WebConfigurer.java.ejs

@@ -41,6 +41,9 @@ import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerF
 <%_ if (reactive && !skipClient) { _%>
 import org.springframework.boot.autoconfigure.web.reactive.ResourceHandlerRegistrationCustomizer;
 <%_ } _%>
+<%_ if (messageBrokerKafka) { _%>
+import org.springframework.cloud.stream.annotation.EnableBinding;
+<%_ } _%>
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 <%_ if (reactive) { _%>
@@ -91,6 +94,9 @@ import java.util.concurrent.TimeUnit;
 /**
  * Configuration of web application with Servlet 3.0 APIs.
  */
+<%_ if (messageBrokerKafka) { _%>
+@EnableBinding({KafkaSseConsumer.class, KafkaSseProducer.class})
+<%_ } _%>
 @Configuration
 public class WebConfigurer implements <% if (!reactive) { %>ServletContextInitializer<% if (!skipClient) { %>, WebServerFactoryCustomizer<WebServerFactory><% } %><% } %><% if (reactive) { %>WebFluxConfigurer<% } %> {
 

package/generators/server/templates/src/main/java/package/security/DomainUserDetailsService.java.ejs

@@ -19,6 +19,9 @@
 package <%= packageName %>.security;
 
 import <%= packageName %>.domain.<%= asEntity('User') %>;
+<%_ if (databaseTypeSql || databaseTypeMongodb || databaseTypeNeo4j) { _%>
+import <%= packageName %>.domain.Authority;
+<%_ } _%>
 import <%= packageName %>.repository.UserRepository;
 import org.hibernate.validator.internal.constraintvalidators.hv.EmailValidator;
 import org.slf4j.Logger;
@@ -60,7 +63,7 @@ public class DomainUserDetailsService implements <% if (reactive) { %>Reactive<%
 
     @Override
 <%_ if (databaseTypeSql) { _%>
-    @Transactional
+    @Transactional(readOnly = true)
 <%_ } _%>
     public <% if (reactive) { %>Mono<UserDetails> findByUsername<% } else { %>UserDetails loadUserByUsername<% } %>(final String login) {
         log.debug("Authenticating {}", login);
@@ -89,8 +92,8 @@ public class DomainUserDetailsService implements <% if (reactive) { %>Reactive<%
             throw new UserNotActivatedException("User " + lowercaseLogin + " was not activated");
         }
         List<GrantedAuthority> grantedAuthorities = user.getAuthorities().stream()<% if (databaseTypeSql || databaseTypeMongodb || databaseTypeNeo4j) { %>
-            .map(authority -> new SimpleGrantedAuthority(authority.getName()))<% } %><% if (databaseTypeCassandra || databaseTypeCouchbase) { %>
-            .map(SimpleGrantedAuthority::new)<% } %>
+            .map(Authority::getName)<% } %>
+            .map(SimpleGrantedAuthority::new)
             .collect(Collectors.toList());
         return new org.springframework.security.core.userdetails.User(user.getLogin(),
             user.getPassword(),

package/generators/server/templates/src/main/java/package/security/jwt/JWTFilter.java.ejs

@@ -75,7 +75,7 @@ public class JWTFilter <% if (reactive) { %>implements WebFilter<% } else { %>ex
         if (StringUtils.hasText(jwt) && this.tokenProvider.validateToken(jwt)) {
             Authentication authentication = this.tokenProvider.getAuthentication(jwt);
 <%_ if (reactive) { _%>
-            return chain.filter(exchange).subscriberContext(ReactiveSecurityContextHolder.withAuthentication(authentication));
+            return chain.filter(exchange).contextWrite(ReactiveSecurityContextHolder.withAuthentication(authentication));
         }
         return chain.filter(exchange);
 <%_ } else { _%>

package/generators/server/templates/src/main/java/package/security/jwt/TokenProvider.java.ejs

@@ -106,7 +106,7 @@ public class TokenProvider {
             .signWith(key, SignatureAlgorithm.HS512)
             .setExpiration(validity)
 <%_ if (reactive) { _%>
-            .serializeToJsonWith(new JacksonSerializer())
+            .serializeToJsonWith(new JacksonSerializer<>())
 <%_ } _%>
             .compact();
     }

package/generators/server/templates/src/main/java/package/security/oauth2/CustomClaimConverter.java.ejs

@@ -31,6 +31,7 @@ import org.springframework.security.oauth2.jwt.MappedJwtClaimSetConverter;
 import org.springframework.security.oauth2.server.resource.web.BearerTokenResolver;
 import org.springframework.security.oauth2.server.resource.web.DefaultBearerTokenResolver;
 import org.springframework.web.client.RestTemplate;
+import org.springframework.web.context.request.RequestAttributes;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
 
@@ -54,6 +55,7 @@ public class CustomClaimConverter implements Converter<Map<String, Object>, Map<
 
     private final ClientRegistration registration;
 
+    // todo: optimize for scale https://github.com/jhipster/generator-jhipster/issues/18868
     private final Map<String, ObjectNode> users = new ConcurrentHashMap<>();
 
     public CustomClaimConverter(ClientRegistration registration, RestTemplate restTemplate) {
@@ -62,14 +64,19 @@ public class CustomClaimConverter implements Converter<Map<String, Object>, Map<
     }
 
     public Map<String, Object> convert(Map<String, Object> claims) {
+        // Only look up user information if identity claims are missing
+        if (claims.containsKey("given_name") && claims.containsKey("family_name")) {
+            return claims;
+        }
         Map<String, Object> convertedClaims = this.delegate.convert(claims);
-        if (RequestContextHolder.getRequestAttributes() != null && ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()) != null) {
+        RequestAttributes attributes = RequestContextHolder.getRequestAttributes();
+        if (attributes instanceof ServletRequestAttributes) {
             // Retrieve and set the token
-            String token = bearerTokenResolver.resolve(((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest());
+            String token = bearerTokenResolver.resolve(((ServletRequestAttributes) attributes).getRequest());
             HttpHeaders headers = new HttpHeaders();
             headers.set("Authorization", buildBearer(token));
 
-            // Retrieve user infos from OAuth provider if not already loaded
+            // Retrieve user info from OAuth provider if not already loaded
             ObjectNode user = users.computeIfAbsent(claims.get("sub").toString(), s -> {
                 ResponseEntity<ObjectNode> userInfo = restTemplate.exchange(registration.getProviderDetails().getUserInfoEndpoint().getUri(), HttpMethod.GET, new HttpEntity<String>(headers), ObjectNode.class);
                 return userInfo.getBody();

package/generators/server/templates/src/main/java/package/service/UserService.java.ejs

@@ -911,7 +911,12 @@ public class UserService {
                 // if IdP sends last updated information, use it to determine if an update should happen
                 if (details.get("updated_at") != null) {
                     Instant dbModifiedDate = existingUser.getLastModifiedDate();
-                    Instant idpModifiedDate = (Instant) details.get("updated_at");
+                    Instant idpModifiedDate;
+                    if (details.get("updated_at") instanceof Instant) {
+                        idpModifiedDate = (Instant) details.get("updated_at");
+                    } else {
+                        idpModifiedDate = Instant.ofEpochSecond((Integer) details.get("updated_at"));
+                    }
                     if (idpModifiedDate.isAfter(dbModifiedDate)) {
                         log.debug("Updating user '{}' in local database", user.getLogin());
                         return updateUser(user.getFirstName(), user.getLastName(), user.getEmail(),
@@ -948,7 +953,12 @@ public class UserService {
             // if IdP sends last updated information, use it to determine if an update should happen
             if (details.get("updated_at") != null) {
                 Instant dbModifiedDate = existingUser.get().getLastModifiedDate();
-                Instant idpModifiedDate = (Instant) details.get("updated_at");
+                Instant idpModifiedDate;
+                if (details.get("updated_at") instanceof Instant) {
+                    idpModifiedDate = (Instant) details.get("updated_at");
+                } else {
+                    idpModifiedDate = Instant.ofEpochSecond((Integer) details.get("updated_at"));
+                }
                 if (idpModifiedDate.isAfter(dbModifiedDate)) {
                     log.debug("Updating user '{}' in local database", user.getLogin());
                     updateUser(user.getFirstName(), user.getLastName(), user.getEmail(),