API Management
API Management
Breadcrumbs

Verify Json Web Token

Contents

This policy verifies the generated JSON Web token. If the token value has been tampered or the token is wrong, it will not allow the user to access the resource.

Configuration

The properties that have to be configured to use the policy are described below.

VerifyJWT.png
Figure 1: Verify Json Web Token policy configuration attributes

Property

Description

JWT Token Identifier

Configure the 

Message Part Identifier

 which contains the Content Type through which the JWT is passed.

Algorithm

Specifies the encryption algorithm (HS256 or RS256 or ES256) which was used for generating the token.

Key ID

The Key ID value corresponding to the algorithm chosen, which is provided in the JSON web keys.

The JSON Public Keys can be provided in the following ways:

  • The Key ID and other parameters of each algorithm can be grouped into a JSON as given in the sample below:

     {"keys":
 [
 {"kty":"EC",
 "crv":"P-256",
 "x":"MKBCTNIcKUSDii11ySs3526iDZ8AiTo7Tu6KPAqv7D4",
 "y":"4Etl6SRW2YiLUrN5vfvVHuhp7x8PxltmWWlbbM4IFyM",
 "use":"sig",
 "kid":"1"},
{
  "kty": "RSA",
  "e": "AQAB",
  "use": "sig",
  "kid": "2011-04-29",
  "alg": "RS256",
  "n": "x7I8Cp-GJvefMI2zN9XvmaowC24Otn082VVEDlt1Uwblujx87ZEdxvXMiEsowx9l2G-nJkVznKLQLnUDcF_zWu9hnByessOv4u-qWGq0inHXn3c-PwzhGoE34Nt7RTVrGYGGqp7wGpGR5m-KP68OG3JW8Sr9p3rifaIrnrhXuAqhXJmoNnAkJNkfB1vA5JFXp0cg9ePBWFN4rR8wI4CEmvO26feaUkTHMFtQLFCYU-OyLcvcbNRLIuBCacvES2uWQ4iclEmlhKBEjLeQox05h974BqmaxBn9V0LO9h4Vbn1w6b1bfrdM28WAXuzbi0YMREardnSmTjPGISjlH2uFJw"
}
 ]
 }

    These JSON web keys (JWK) have to be fed into the Context Variable named "PublicJsonWebKeys" using the Assign Variables policy.

    For the JWK structure as in the sample above, refer to the link: https://tools.ietf.org/html/rfc7517



  • If the JSON Web keys have to be fetched from a File Store, a Callout policy can be used.

  • If the JSON Web keys are exposed in an HTTPS URL (Eg: https://www.googleapis.com/oauth2/v3/certs), a Service Callout policy can be used and the response can be assigned to Context Variables using Assign Variables policy to fetch the keys.

Subject

Subject of the JWT issued as provided in the Json Web Token policy.

Provide values for Subject, Issuer andAudience (described below) only if these values are provided in the Json Web Token policy

Issuer

The "iss" (issuer) claim identifies the entity that issues the JWT. Provide the same as provided in the Json Web Token policy.

Audience

Recipient value. The audience value is comprised of comma separated strings.

This property is optional.

Additional Claim

To provide custom claims other than the above properties.

Secret Key

Where HS256 symmetric algorithm is chosen, Secret Key has to be provided. The minimum length of the string has to be 256 bit.

Verifying a json web token

Request

Use the following URL in the browser/postman: 

http://192.168.2.231:2160/jsonVerifytoken/1.0?jwt-token=ewogICJ0eXBlIiA6ICJKV1QiLAogICJhbGciIDogIkhTMjU2IiwKICAia0lEIiA6ICIxMjM0NTYiCn0=.ewogICJzdWIiIDogIkpzb24tVG9rZW4tR2VuZXJhdGlvbiIsCiAgImlzcyIgOiAiRmlvcmFubyBzb2Z0d2FyZSBwcml2YXRlIGx0ZC4iLAogICJhdWQiIDogImF1ZGllbmNlIiwKICAiaWF0IiA6ICIyMDE4LTA5LTExIDIyOjM1OjEwIiwKICAiZXhwIiA6ICIyMDE4LTA5LTE1IDIyOjM1OjEwIiwKICAic2hvdyIgOiAiZmlvcmFubyIsCiAgImFkZGl0aW9uYWxDbGFpbSIgOiB7IH0KfQ==.n8YbWfgmw9v/4iYOnC7G2qFLhzUf3jVgQHUK8oWn7qg=
Response

Attains access of the resources if the token is valid.