Authorization using JWT verification

CRDP supports securing its APIs using JSON Web Tokens (JWTs) issued by trusted identity providers. JWTs allow clients to authenticate and access CRDP resources securely.

To use this feature, JWT verification must be enabled on CipherTrust Manager. Refer to Enable JWT Verification for details.

CRDP supports two types of JWTs:

• Regular JWTs

• DPoP-bound JWTs (JWTs bound to a client’s key using the DPoP mechanism)

Support for DPoP-bound JWTs will be available in CipherTrust Manager 2.22 and higher versions.

Both formats are validated by CRDP to ensure the authenticity and integrity of the request.

JWT Structure

JWTs are made of three Base64URL-encoded parts:

    <header>.<payload>.<signature>

CRDP uses each section to validate the request.

Header

The header defines the algorithm used to sign the JWT and its type.

    {
    "alg": "RS256",
    "typ": "JWT"
    }

    {
    "alg": "RS256",
    "typ": "dpop+jwt"
    }

Supported Signing Algorithms

CRDP currently supports the following JWT signing algorithms:

• RS256 – RSA using SHA-256

• RS384 – RSA using SHA-384

• RS512 – RSA using SHA-512

• ES256 – ECDSA using P-256 curve and SHA-256

• ES384 – ECDSA using P-384 curve and SHA-384

• ES512 – ECDSA using P-512 curve and SHA-512

• PS256 – RSASSA-PSS using SHA-256

• PS384 – RSASSA-PSS using SHA-384

• PS512 – RSASSA-PSS using SHA-512

Payload

CRDP expects specific claims in the payload to authorize access.

    {
        "exp": "1234567890", 
        "iss": "John Doe" 
    }

    {
        "exp": "1234567890", 
        "iss": "John Doe",
        "cnf": {
                "jkt": "orYt32aTSMKPVSPQKsDSAk4MP_-o7mPmIHn7mzSv3y4"
            }
    }

Signature

The JWT must be signed with the identity provider’s private key using any of the supported algorithm.

CRDP verifies the signature using:

• Static public key

• JWKS URL