JWT
The JWT Policy helps you to validate JSON Web Tokens (JWT) by providing a signing key or a JSON Web Key Set (JWK(S)). You can also require claims and strip them to forward them as header to the backend API.
If you are using the JWT or Keycloak OAuth policy, an authentication dialog is shown in the API Developer Portal that you need to use to consume the API. To support you during testing, API Management provides the default user token, if you leave the authentication dialog empty. If you make your own entries in the dialog, these are used in preference to the default. Refer to Testing APIs for details.
Configuration Options
Basic Configuration
Option | Description | Possible Values | Default |
---|---|---|---|
Signing Key or URL to a JWK(S) | Specify a Base-64 encoded signing key or a URL to a JWK(S) to validate JWT. Self-signed certificates are currently not supported. |
| FQDN path automatically set for your PAS installation |
Key ID (kid) of JWK(S) | Specify the key id of the JWK(S) in this field if you provided a JWK(S) URL. | a valid string | - |
Required Claims
All standard claims, custom claims and ID token fields are available (case sensitive). A special value of access_token will forward the entire encoded token. Nested claims can be accessed by using the JavaScript dot syntax (e.g: address.country, address.formatted).
Option | Description | Possible Values | Default |
---|---|---|---|
Claim | Specify a list of required claims. If a required claim is not present, access will be rejected. | a string | - |
Value | Determines the content of the claim. | a string | - |
Click Add to create more rows in the table. Click Delete to remove selected rows. |
Forward Claim Information
Fields from the JWT can be set as headers and forwarded to the API. All standard claims, custom claims and ID token fields are available (case sensitive). A special value of access_token will forward the entire encoded token. Nested claims can be accessed by using the JavaScript dot syntax (e.g: address.country, address.formatted).
Option | Description | Possible Values | Default |
---|---|---|---|
Field | Specify a list of fields from the JWT to be forwarded to the API as a header. | a string | - |
Header | Holds the value of the Field. | a string | - |
Click Add to create more rows in the table. Click Delete to remove selected rows. |
Advanced Configuration
Option | Description | Possible Values | Default |
---|---|---|---|
Require Signed JWT (JWS) | Specify whether JWTs must be cryptographically signed and verified (JWS). It is stongly recommended to enable this option. |
| enabled |
Strip Tokens | Enable if the Authorization header or token query parameter should be removed before forwarding traffic to the API. |
| disabled |
Maximum Clock Skew | Specify the maximum allowed clock skew in seconds when validating exp (expiry) and nbf (not before) claims. 0 implies default behavior. | a valid integer | 0 |
Related Pages: