Authorization using JWT Verification

CRDP provides JWT verification feature to authorized users who want to access the CRDP resources (APIs). To use this feature, JWT verification must be enabled. Refer to Enable JWT Verification for details.

Whenever users want to access the CRDP resources (APIs), a JWT should be sent in the Authorization Header using the Bearer schema. CRDP will check the valid JWT in the Authorization Header. If a valid JWT is present, user will be allowed to access the CRDP resources (APIs).

The JWT structure for any incoming request to CRDP should include the following parts:

• Header

  • type: Specifies the token type supported by CRDP. CRDP supports only Bearer Token.

  • algorithm: Specifies the signing algorithm supported by CRDP. CRDP supports only RS256.

• Payload

  The payload contains claims. The supported registered claims are: iss (issuer) and exp (expiry).

  • Issuer: This claim is optional. It identifies the principal that issued the JWT. Validate the iss claim from the JWT with the Issuer field provided in the application configuration.

    Note

    If value is set in the Issuer field while configuring an application on the CipherTrust Manager, the payload must contain the iss (issuer) with the same value as set on the CipherTrust Manager. For example, if value in the Issuer field on the CipherTrust Manager is https://example.com, the payload must contain the same value as shown below:

    "iss": "https://example.com"

  • Expiry: This claim is mandatory. It identifies the expiration time of the JWT.

• Signature

  This part of the JWT structure verifies the signature.

CRDP allows JWT verification using the Public Key and JWKS URL. Click the desired tab for details.