🔗 Request & Filters

• HttpServletRequest → incoming request.
• SecurityFilterChain → wires filters.
• BearerTokenAuthenticationFilter → extracts Authorization: Bearer …, calls AuthenticationManager.

⚙️ Routing & Managers

• JwtIssuerAuthenticationManagerResolver
  • Reads iss from the token (peek only).
  • Returns the correct AuthenticationManager for that issuer/realm.
  • Think: “Which manager should handle this token?”
• AuthenticationManager (usually ProviderManager)
  • Delegates to one of its AuthenticationProviders.
  • Think: “Which provider knows how to authenticate this token?”
• JwtAuthenticationProvider (implements AuthenticationProvider)
  • Glue between JwtDecoder + JwtAuthenticationConverter and Spring’s provider model.
  • uses JwtDecoder → validate signature, issuer, expiry → produce a Jwt.
  • uses JwtAuthenticationConverter → read claims → map to GrantedAuthority.
  • returns a JwtAuthenticationToken (which implements Authentication).
  • Think: “Turn a raw JWT into a trusted Spring Authentication.”

🔑 JWT Validation & Conversion

• JwtDecoder → validates signature/exp/iss → produces Jwt.
• Jwt → parsed claims.
• JwtAuthenticationConverter → converts Jwt → authorities.
• Converter → generic interface (e.g. Jwt → Collection<GrantedAuthority>).

👤 Authentication Objects

• JwtAuthenticationToken → extends AbstractAuthenticationToken → implements Authentication, holds Jwt, principal, authorities.
• Authentication → contract for current identity.