Hi,

I'm using the [jwt:<jct-id>] stanza to create a JWT at the junction level. I have a developer asking what the password is to open that JWT. He's using a library that requires a password in order to build objects from the claims in the JWT. Would this be the password for the KDB that is used to sign the key?

Thanks,
Scott

------------------------------
Scott Reichardt
IBM Security Verify Access v10
------------------------------

Hi Scott,

A JWT can be signed with either a symmetric or asymmetric key.  If your developer is talking about a "password" that is probably referring to a symmetric key signature.

I'm not 100% sure but, reading the docs, I'm pretty sure that the built in JWT support in Verify Access 10 Reverse Proxy can only create a signature using asymmetric key (based on specified key in keystore).

It would be worth asking the developer if the library they are using to consume the JWT supports asymmetric key signature as well as "password". If it does, it may require the key to be published at a JWKS endpoint. Is so, Verify Access 10 does support that.

if you MUST have a JWT signed with symmetric key then this is possible using the JWT implementation in the federation add-on STS. In that case, you'd need to switch to using "TFIM SSO" junction option instead of using the build in JWT code in Reverse Proxy.

Jon. 

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------