DataPower

To implement the OAuth2-JWT bearer authentication grant type (urn:ietf:params:oauth:client-assertion-type:jwt-bearer) where IBM DataPower acts as both the Authorization Server (AS) and Resource Server (RS), you need to configure an OAuth Security Requirement or an AAA Policy [1]. DataPower natively supports this via its native OAuth Multi-Protocol Gateway (MPGW) configuration or the API Connect gateway service [1].Here is the direct, step-by-step implementation guide to achieve this workflow based on your incoming XML request structure.

Extract the ParametersBecause DataPower parses your incoming payload into an XML structure, you must first isolate the client_assertion and grant_type values. Use a GatewayScript (GWS) or an XSLT stylesheet action at the very beginning of your Request rule to extract these variables and populate the API context or DataPower system variables.GatewayScript Example:

var session = require('context');

// Read the incoming parsed XML payload
session.input.readAsXML(function(error, xmlDoc) {
    if (error) {
        session.reject("Failed to parse incoming XML request.");
        return;
    }
    
    // Extract the assertion token string
    var assertion = xmlDoc.getElementsByTagName("arg");
    for (var i = 0; i < assertion.length; i++) {
        var name = assertion[i].getAttribute("name");
        if (name === "client_assertion") {
            session.setVariable('var://context/oauth/client_assertion', assertion[i].textContent.trim());
        }
        if (name === "grant_type") {
            session.setVariable('var://context/oauth/grant_type', assertion[i].textContent.trim());
        }
    }
});

Verify the Incoming JWT AssertionBefore issuing an OAuth access token, DataPower must validate the signature and claims inside the client_assertion JWT token string.Navigate to Objects → Crypto Configuration → Crypto Certificate and upload the public certificate corresponding to the issuer (SvcNow-CAFOB).Create a JWT Validator object:Issuer Claim: Set this to expect SvcNow-CAFOB.Audience Claim: Set this to verify EDE.Crypto Certificate: Reference the certificate uploaded in step 1.In your processing rule, implement a Validate JWT action or utilize an AAA Policy:Set the JWT Source to a custom variable expression pointing to: var://context/oauth/client_assertion.Bind the JWT Validator object you just created.

Configure the OAuth Authorization ServerTo handle the token generation (/token2), configure an OAuth Provider Settings object inside DataPower to act as the native AS:Supported Grant Types: Check the boxes for JWT Bearer.Token Generation: Configure a JWT Generator object within the provider settings to mint the new access token that will be given back to the client application.Client Authentication Profile: Specify how the metadata maps. Under the OAuth metadata processing, ensure that the verification maps the identity found inside the client_assertion to an internal registry if application validation is strictly required.

Process and Generate Token ResponsesOnce the Validate JWT action passes successfully, execution proceeds down the Request rule to an OAuth processing action:Add an OAuth Access Token Generation processing action.Ensure the processing state flags that the client identities matched the claims inside the assertion payload (iss and role).DataPower will automatically assemble an explicit JSON response payload containing your newly generated OAuth access token, type, and expiration matrix:

{
  "access_token": "eyJhbG...",
  "token_type": "Bearer",
  "expires_in": 3600
}