JWT Token Generation

This section provides instructions on how to get the user claims of the authorized user as a JWT token with the validation response. 

Configurations

1. Open the <IS_HOME>/repository/conf/identity/identity.xml file and set the <Enabled> element (found under the <OAuth>,<AuthorizationContextTokenGeneration> elements) to true as shown in the code block below. 

   <AuthorizationContextTokenGeneration>
               <Enabled>true</Enabled>
               <TokenGeneratorImplClass>org.wso2.carbon.identity.oauth2.authcontext.JWTTokenGenerator</TokenGeneratorImplClass>
               <ClaimsRetrieverImplClass>org.wso2.carbon.identity.oauth2.authcontext.DefaultClaimsRetriever</ClaimsRetrieverImplClass>
               <ConsumerDialectURI>http://wso2.org/claims</ConsumerDialectURI>
               <SignatureAlgorithm>SHA256withRSA</SignatureAlgorithm>
               <AuthorizationContextTTL>15</AuthorizationContextTTL>
    </AuthorizationContextTokenGeneration> 

2. Add the following property under <OAUTH> section to use the JWT Token Builder instead of the default Token Builder.

   <IdentityOAuthTokenGenerator>org.wso2.carbon.identity.oauth2.token.JWTTokenIssuer</IdentityOAuthTokenGenerator> 

   If you need to use a self-contained access token generator, make sure you change the above values accordingly.

3. The following configurations are optional and can be configured as needed.

1. See the Extension Points for OAuth topic for more details about the usage of the 'TokenGeneratorImplClass' and 'ClaimsRetrieverImplClass'. 

2. ConsumerDialectURI: Defines the URI for the claim dialect under which the user attributes need to be retrieved. 

3. SignatureAlgorithm: Defines the algorithm to be used in signing the payload that carries user claims. If you want to disable signing of the JWT token, set this element to "NONE". 

   <SignatureAlgorithm>NONE</SignatureAlgorithm>

4. AuthorizationContextTTL: Defines the expiry time for JWT token in minutes.

Calling the OAuth2ValidationService with a valid token

After configuring the elements mentioned above, see the OAuth2 Token Validation and Introspection topic to call the OAuth2ValidationService. The following screenshot is the request and response of the OAuth2ValidationService from the SOAP UI. Additionally, it shows the required claims of the user as required claim URIs. In the response, you can see the received JWT token under the <tokenString> element. 

Header Metadata: 
The header contains the metadata for the token as seen below. 

Decoded Header: 

Decoded Payload:

{  
   "http:\/\/wso2.org\/gateway\/applicationname":"Oauth7",
   "exp":1452594892,
   "sub":"admin@carbon.super",
   "http:\/\/wso2.org\/gateway\/subscriber":"admin@carbon.super",
   "iss":"http:\/\/wso2.org\/gateway",
   "http:\/\/wso2.org\/gateway\/enduser":"admin@carbon.super",
   "http:\/\/wso2.org\/claims\/role":"admin,Application\/dewvdew,Application\/Oauth7,Internal\/everyone",
   "http:\/\/wso2.org\/claims\/emailaddress":"admin@wso2.com",
   "iat":1452593254,
   "http:\/\/wso2.org\/claims\/organization":"WSO2"
}

Signature verification

The signature verification can be done similar to the ID token signature verification. 

package org.sample;

import java.io.InputStream;
import java.security.KeyStore;
import java.security.cert.Certificate;
import java.security.interfaces.RSAPublicKey;

import com.nimbusds.jose.JWSVerifier;
import com.nimbusds.jose.crypto.RSASSAVerifier;
import com.nimbusds.jwt.SignedJWT;

public class ValidateRSASignature {

    public static void main(String[] args) throws Exception {
        RSAPublicKey publicKey = null;
        InputStream file = ClassLoader
                .getSystemResourceAsStream("wso2carbon.jks");
        KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
        keystore.load(file, "wso2carbon".toCharArray());

        String alias = "wso2carbon";

        // Get certificate of public key
        Certificate cert = keystore.getCertificate(alias);
        // Get public key
        publicKey = (RSAPublicKey) cert.getPublicKey();

        // Enter JWT String here
        String signedJWTAsString = "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJhbGljZSIsImlzcyI6Imh0d";

        SignedJWT signedJWT = SignedJWT.parse(signedJWTAsString);

        JWSVerifier verifier = new RSASSAVerifier(publicKey);

        if (signedJWT.verify(verifier)) {
            System.out.println("Signature is Valid");
        } else {
            System.out.println("Signature is NOT Valid");
        }
    }
}