As previously mentioned, the authentication service will have two APIs—one for issuing a JWT token following authentication of the user, and another to check the validity of the issued JWT token.

First, let's add the following dependencies to the authentication service:

        <dependency>
            <groupId>org.jetbrains.kotlin</groupId>
            <artifactId>kotlin-stdlib-jdk8</artifactId>
            <version>${kotlin.version}</version>
        </dependency>
        <dependency>
            <groupId>org.jetbrains.kotlin</groupId>
            <artifactId>kotlin-test</artifactId>
            <version>${kotlin.version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-server</artifactId>
            <version>${jersey-server}</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-json</artifactId>
            <version>${jersey-json}</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-client</artifactId>
            <version>${jersey-client}</version>
        </dependency>

        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>${javax.servlet-api}</version>
        </dependency>
        <dependency>
            <groupId>javax.annotation</groupId>
            <artifactId>javax.annotation-api</artifactId>
            <version>${javax.annotation-api}</version>
        </dependency>
        <dependency>
            <groupId>javax.enterprise</groupId>
            <artifactId>cdi-api</artifactId>
            <version>${javax.enterprise.cdi.api}</version>
        </dependency>

        <dependency>
            <groupId>org.glassfish.soteria</groupId>
            <artifactId>javax.security.enterprise</artifactId>
            <version>${org.glassfish.soteria}</version>
        </dependency>
        <dependency>
            <groupId>org.glassfish</groupId>
            <artifactId>javax.security.auth.message</artifactId>
            <version>${javax.security.auth.message}</version>
        </dependency>

        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
            <version>${jjwt}</version>
        </dependency>
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>${java-jwt}</version>
        </dependency>   

Then, let's add the following packages to the AuthenticationService:

The store package is for the custom identity store that we explained earlier and this will be used for authentication. The jwt package will have the code construct for issuing and verifying the JWT. The authentication mechanism classes, which are used to interact with the data store, go into the auth package, while the controller will have the APIs that are exposed over the REST.