Verify Json Web Token

Contents

This policy verifies the generated JSON Web token. If the token value has been tampered or the token is wrong, it will not allow the user to access the resource.

Configuration

The properties that have to be configured to use the policy are described below.

Figure 1: Verify Json Web Token policy configuration attributes

Property	Description
JWT Token Identifier	Configure the Message Part Identifier which contains the Content Type through which the JWT is passed.
Algorithm	Specifies the encryption algorithm (HS256 or RS256 or ES256) which was used for generating the token.
Key ID	The Key ID value corresponding to the algorithm chosen, which is provided in the JSON web keys. The JSON Public Keys can be provided in the following ways: The Key ID and other parameters of each algorithm can be grouped into a JSON as given in the sample below: CODE {"keys": [ {"kty":"EC", "crv":"P-256", "x":"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4", "y":"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM", "use":"sig", "kid":"1"}, { "kty": "RSA", "e": "AQAB", "use": "sig", "kid": "2011-04-29", "alg": "RS256", "n": "x7I8Cp-GJvefMI2zN9XvmaowC24Otn082VVEDlt1Uwblujx87ZEdxvXMiEsowx9l2G-nJkVznKLQLnUDcF_zWu9hnByessOv4u-qWGq0inHXn3c-PwzhGoE34Nt7RTVrGYGGqp7wGpGR5m-KP68OG3JW8Sr9p3rifaIrnrhXuAqhXJmoNnAkJNkfB1vA5JFXp0cg9ePBWFN4rR8wI4CEmvO26feaUkTHMFtQLFCYU-OyLcvcbNRLIuBCacvES2uWQ4iclEmlhKBEjLeQox05h974BqmaxBn9V0LO9h4Vbn1w6b1bfrdM28WAXuzbi0YMREardnSmTjPGISjlH2uFJw" } ] } These JSON web keys (JWK) have to be fed into the Context Variable named "PublicJsonWebKeys" using the Assign Variables policy. For the JWK structure as in the sample above, refer to the link: https://tools.ietf.org/html/rfc7517 If the JSON Web keys have to be fetched from a File Store, a Callout policy can be used. If the JSON Web keys are exposed in an HTTPS URL (Eg: https://www.googleapis.com/oauth2/v3/certs), a Service Call Out policy can be used and the response can be assigned to Context Variables using Assign Variables policy to fetch the keys.
Subject	Subject of the JWT issued as provided in the Json Web Token policy. Provide values for Subject, Issuer andAudience (described below) only if these values are provided in the Json Web Token policy
Issuer	The "iss" (issuer) claim identifies the entity that issues the JWT. Provide the same as provided in the Json Web Token policy.
Audience	Recipient value. The audience value is comprised of comma separated strings. This property is optional.
Additional Claim	To provide custom claims other than the above properties.
Secret Key	Where HS256 symmetric algorithm is chosen, Secret Key has to be provided. The minimum length of the string has to be 256 bit.

Verifying a json web token

Request

Use the following URL in the browser/postman:

JWT Token Verify URL

CODE

http://192.168.2.231:2160/jsonVerifytoken/1.0?jwt-token=ewogICJ0eXBlIiA6ICJKV1QiLAogICJhbGciIDogIkhTMjU2IiwKICAia0lEIiA6ICIxMjM0NTYiCn0=.ewogICJzdWIiIDogIkpzb24tVG9rZW4tR2VuZXJhdGlvbiIsCiAgImlzcyIgOiAiRmlvcmFubyBzb2Z0d2FyZSBwcml2YXRlIGx0ZC4iLAogICJhdWQiIDogImF1ZGllbmNlIiwKICAiaWF0IiA6ICIyMDE4LTA5LTExIDIyOjM1OjEwIiwKICAiZXhwIiA6ICIyMDE4LTA5LTE1IDIyOjM1OjEwIiwKICAic2hvdyIgOiAiZmlvcmFubyIsCiAgImFkZGl0aW9uYWxDbGFpbSIgOiB7IH0KfQ==.n8YbWfgmw9v/4iYOnC7G2qFLhzUf3jVgQHUK8oWn7qg=

Response

Attains access of the resources if the token is valid.