Spring OAuth2 flow with azure-ad

Question

Current setup:

• Frontend (Angular)
• Reverse Proxy (Nginx)
• BFF (Spring Gateway & Spring OAuth2 Client)
• IDP (Azure AD)
• Resource Server (Spring Resource Server)

I'm currently stuck with the oauth2 flow with azure-ad (login.live.com).

This is how my flow currently looks:

The Problem

The probem that i now have, is that the resource server can't handle the access-token (opaque Token) since azure doesn't have a Introspect endpoint to validate the access-token (https://login.live.com/.well-known/openid-configuration).

Possible solution

1. One way would be, to send the id_token down the stream (to the resource server), but that shouldn't be that way if i'm not wrong. I'm also not sure if spring is supporting that.

2. Create a custom jwt for the communication between the bff and resource server. (A lot of efford)

3. Let the BFF handle the authentication entirely (inside the same k8s cluster). Would work, but some security concerns (Request Spoofing)