JWT Parser sample configuration

In this example, the attribute connector is configured to obtain the JWT source from the attribute jwt, which will be provided by the connector host, and store the value of the sub claim in the attribute subjectId.

It's also configured to accept only tokens that meet the following criteria:

• Have a valid HMAC signature.
• Have not expired (allowing for a 5-second skew).
• Are not being used before their activation time, if such a time is present in the token.
• Have been issued by either trusted-iss or another-trusted-iss.
• Are intended for the accepted-aud audience.

XML

jwtParser.config.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration xmlns="http://www.axiomatics.com/attributeconnector/parser/jwt/configuration" identifier="jwt-parser">
  <source>
    <xacmlAttribute Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
      AttributeId="jwt"
      DataType="http://www.w3.org/2001/XMLSchema#string"/>
  </source>
  <signature>
    <signatureKey>
      {"kty":"oct","k":"NTk2MjhFNUNBNjk1RDc4NjY3RTZCRUIyQzU5MTdFNkU2NjdBQTA2N0I2QjZCRTg5RUI3MUMwQTZDRjYzNTA0MQ"}
    </signatureKey>
  </signature>
  <assertions>
    <notExpired skewInSeconds="5"/>
    <notBefore optional="true"/>
    <issuer value="trusted-iss">
      <value>another-trusted-iss</value>
    </issuer>
    <audience value="accepted-aud"/>
  </assertions>
  <mapping>
    <xacmlAttribute Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
      AttributeId="subjectId"
      DataType="http://www.w3.org/2001/XMLSchema#string"/>
    <claim>sub</claim>
  </mapping>
</configuration

JSON

JSON configuration files offer the option to use either ALFA or XACML for policy definitions.

XACML

jwtParser.config.json

{
  "identifier": "jwt-parser",
  "source": {
    "xacmlAttribute": {
      "category": "urn:oasis:names:tc:xacml:3.0:attribute-category:subject",
      "attributeId": "jwt",
      "datatype": "http://www.w3.org/2001/XMLSchema#string",
      "issuer": null
    }
  },
  "signature": {
    "signatureKey": {
      "value": "{\"kty\":\"oct\",\"k\":\"NTk2MjhFNUNBNjk1RDc4NjY3RTZCRUIyQzU5MTdFNkU2NjdBQTA2N0I2QjZCRTg5RUI3MUMwQTZDRjYzNTA0MQ\"}"
    }
  },
  "assertions": {
    "notExpired": {
      "skewInSeconds": 5
    },
    "notBefore": {
      "optional": true
    },
    "issuer": {
      "values": ["another-trusted-iss"],
      "optional": false,
      "value": "trusted-iss"
    },
    "audience": {
      "value": "accepted-aud"
    }
  },
  "mappings": [
    {
      "xacmlAttribute": {
        "category": "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject",
        "attributeId": "subjectId",
        "datatype": "http://www.w3.org/2001/XMLSchema#string",
        "issuer": null
      },
      "claim": "sub"
    }
  ]
}

ALFA

jwtParser.config.alfa.json

{
  "identifier": "jwt-parser",
  "source": {
    "attributeName": "jwt"
  },
  "signature": {
    "signatureKey": {
      "value": "{\"kty\":\"oct\",\"k\":\"NTk2MjhFNUNBNjk1RDc4NjY3RTZCRUIyQzU5MTdFNkU2NjdBQTA2N0I2QjZCRTg5RUI3MUMwQTZDRjYzNTA0MQ\"}"
    }
  },
  "assertions": {
    "notExpired": {
      "skewInSeconds": 5
    },
    "notBefore": {
      "optional": true
    },
    "issuer": {
      "values": [
        "another-trusted-iss"
      ],
      "optional": false,
      "value": "trusted-iss"
    },
    "audience": {
      "value": "accepted-aud"
    }
  },
  "mappings": [
    {
      "attributeName": "subjectId",
      "claim": "sub"
    }
  ]
}

YAML

YAML configuration files offer the option to use either ALFA or XACML for policy definitions.

XACML

jwtParser.config.yaml

identifier: jwt-parser
source:
  xacmlAttribute:
    category: "urn:oasis:names:tc:xacml:3.0:attribute-category:subject"
    attributeId: jwt
    dataType: "http://www.w3.org/2001/XMLSchema#string"
    issuer: null
signature:
  signatureKey:
    value: >-
      {"kty":"oct","k":"NTk2MjhFNUNBNjk1RDc4NjY3RTZCRUIyQzU5MTdFNkU2NjdBQTA2N0I2QjZCRTg5RUI3MUMwQTZDRjYzNTA0MQ"}
assertions:
  notExpired:
    skewInSeconds: 5
  notBefore:
    optional: true
  issuer:
    values:
      - another-trusted-iss
    optional: false
    value: trusted-iss
  audience:
    value: accepted-aud
mappings:
  - xacmlAttribute:
      category: "urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
      attributeId: subjectId
      dataType: "http://www.w3.org/2001/XMLSchema#string"
    claim: sub

ALFA

jwtParser.config.alfa.yaml

identifier: jwt-parser
source:
  attributeName: jwt
signature:
  signatureKey:
    value: >-
      {"kty":"oct","k":"NTk2MjhFNUNBNjk1RDc4NjY3RTZCRUIyQzU5MTdFNkU2NjdBQTA2N0I2QjZCRTg5RUI3MUMwQTZDRjYzNTA0MQ"}
assertions:
  notExpired:
    skewInSeconds: 5
  notBefore:
    optional: true
  issuer:
    values:
      - another-trusted-iss
    optional: false
    value: trusted-iss
  audience:
    value: accepted-aud
mappings:
  - attributeName: subjectId
    claim: sub