Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

OAuth 2.0 and OpenID Connect

ID token encryption

search

ID token encryption

ID token encryption provides the confidentiality of the claims within the ID token.

Configure encryption

The OneWelcome Identity Platform must be configured to enable ID token encryption. The encryption method and JSON Web Key Sets (JWKS) endpoint must be configured to use encryption.

You can read more about configuring a web client with encryption support.

Choose an encryption method

Following OpenID Connect standards, several different encryption methods for a Content Encryption Key (CEK) are supported. This CEK is automatically generated based on the method that you choose, and the length varies accordingly. To see which encryption methods are supported, see the discovery API. You need to configure the encryption method on the web client and use it in your client application when decrypting the ID token.

Provide a JWKS endpoint for encryption

The OneWelcome Identity Platform supports a remote key set for encrypting the generated CEK. As the relying party, public keys must be shared using this endpoint, so the OneWelcome Identity Platform can retrieve them to encrypt the CEK. For help with implementation, see the documentation on OpenID Connect Encryption.

The endpoint that is served from your application must return a list of JWKS. For implementation details, see the RFC specification. A proper max-age directive must be included with the Cache-Control header as a part of the response. If none is provided, the time-to-live (TTL) defaults to the REDIS_DEFAULT_JWKS_URI_RESPONSE_TTL_SECONDS environment variable value. Make sure that you consider key rotation as described in the spec.

The OneWelcome Identity Platform supports several different asymmetric algorithms. For information about which algorithms are supported, see the discovery API.

Decryption library

To help with decryption in your application, you can use the Nimbus JOSE+JWT library. It contains constants for the encryption methods and algorithms that are supported by the OneWelcome Identity Platform implementation. It simplifies the code necessary for decrypting the JWE and verifying the signed JWT.

On this page