Verify Json Web Token

Property

Description

JWT Token Identifier

Configure the 

 with the source as header/Query parameter/context variable/constant through which the JWT is passed.

Headers

Algorithm

Specifies the encryption/signed algorithm which was used to encrypt/sign the JWT provided in the JWT Token Identifier property above.

Supported algorithms are HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512 , NONE.

Provide any of the above-mentioned algorithm values as input to be used to verify the token.

Key ID

The Key ID value corresponding to the algorithm (specified in the Algorithm property above) as provided in the  or the keys exposed in the  (described below).

Known Headers

Verify JWT policy examines "crit" parameter in the JWT header, if present, and checks that each value listed under "crit" contained in JWT provided for validation is present among the entries under this "Known Headers" element  i.e the "Known Headers" must contain a superset of the items listed in JWT's "crit" header. Any header that is found in "crit" header that is not specified here among <KnownHeaders> causes the policy to fail.

Claims Configuration

Subject

This value should be same as that of the "sub" claim of the provided JWT for it to be valid.

Issuer

The "iss" (issuer) claim identifies the entity that issues the JWT. Provide the same value as that of "iss" claim contained in the provided JWT.

Audience

The "aud" claim identifies the intended audience/recipients of the JWT. The audience value is comprised of comma separated string. Make sure this value is present among those in "aud" claim of JWT provided for successful validation.

This property is optional.

Additional Claim

Source-configurable custom claims can be specified here in order to verify their values against those present in the JWT provided for validation.Make sure every claim specified here is contained in the provided JWT, otherwise it is invalidated.

Key Configuration

Secret Key

Provide when a symmetric algorithm like HS256 is specified. The minimum length of the string has to be 256,384,512 bits for HS256,HS384,HS512 respectively.

Json Web Keys

Provide when an asymmetric algorithm like RS256 or ES256 is specified. A sample is as shown below:

 {"keys":
 [{
  "kty": "EC",
  "use": "sig",
  "crv": "P-256",
  "kid": "1",
  "x": "sBNgwW1i-A62HVWQZxN0Z57ZZ3adKFji2AyXAUH2j-s",
  "y": "fHyE4jHp1YYpoKUcrokfN7E7CmxQLysUT4-Y9ub0wJo",
  "alg": "ES256"
},{
  "kty": "RSA",
  "e": "AQAB",
  "use": "sig",
  "kid": "2",
  "alg": "RS256",
  "n": "qweevvZFA-bpSiv3DaA1jDOPE9mYlXIwlYH0Hs8kYpW2iocpVVEu10sRSbS97P4-pljKswkLcDZfDPejZ97X5PQ8jPPtTwqahxoGdXl6mkMmFT-AdG5m3tUFMGHO5uWxFwSy-R2eqHkq8i_8O7ByjUlZSzoo4NEpGvAWdPHv3BUl-zIciWj-DZaCutrasf9-_LjKiX-0q8-z8i9umfz6Wl5VjWorrUQAzShDTdLR6F02e8mMleJdnV8tEi6KceXkbU15q4xG-0pcgv3sov8kNjtgmggaN8dkQRbpx9zEI__X5-WqvIB1RO0n4BUPhBKeus5TCN2rrZph7dNVRHdJxw"
}
 ]
 }

Load Keys From URL

If Public Json Web Keys are exposed in a specific URL, then enable this property.

Keys URL

Specify the URL in which Public Json Web Keys are exposed.