Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CT-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Crypto Command Center
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Windows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

OAuth 2.0 and OpenID Connect

ID token encryption

search
printsuggest an editpdf paneldownload

ID token encryption

ID token encryption provides the confidentiality of the claims within the ID token.

copy link to clipboardConfigure encryption

The OneWelcome Identity Platform must be configured to enable ID token encryption. The encryption method and JSON Web Key Sets (JWKS) endpoint must be configured to use encryption.

You can read more about configuring a web client with encryption support.

copy link to clipboardChoose an encryption method

Following OpenID Connect standards, several different encryption methods for a Content Encryption Key (CEK) are supported. This CEK is automatically generated based on the method that you choose, and the length varies accordingly. To see which encryption methods are supported, see the discovery API. You need to configure the encryption method on the web client and use it in your client application when decrypting the ID token.

copy link to clipboardProvide a JWKS endpoint for encryption

The OneWelcome Identity Platform supports a remote key set for encrypting the generated CEK. As the relying party, public keys must be shared using this endpoint, so the OneWelcome Identity Platform can retrieve them to encrypt the CEK. For help with implementation, see the documentation on OpenID Connect Encryption.

The endpoint that is served from your application must return a list of JWKS. For implementation details, see the RFC specification. A proper max-age directive must be included with the Cache-Control header as a part of the response. If none is provided, the time-to-live (TTL) defaults to the REDIS_DEFAULT_JWKS_URI_RESPONSE_TTL_SECONDS environment variable value. Make sure that you consider key rotation as described in the spec.

The OneWelcome Identity Platform supports several different asymmetric algorithms. For information about which algorithms are supported, see the discovery API.

copy link to clipboardDecryption library

To help with decryption in your application, you can use the Nimbus JOSE+JWT library. It contains constants for the encryption methods and algorithms that are supported by the OneWelcome Identity Platform implementation. It simplifies the code necessary for decrypting the JWE and verifying the signed JWT.

On this page