OAuth Functions
This section describes functions that relates to OAuth operations.
The following functions for OAuth described here are:
validateJwt
Validates an incoming OAuth JWT.
string validateJwt(
string openIdServer,
string token,
map <string, any> claimsToValidate, //Optional
string algorithm //Optional)Parameters
Parameter | Description |
|---|---|
| This is the URL for the JWKS server. It stores the JWKS in the cache. Example - JWKS Cache The cache is accessible only from the backend and cannot be updated by users. It is used to reduce the number of connections to the {
"[openIdServer + kid #1]": {
"use": "sig",
"kty": "RSA",
"kid": "e1583dde-e337-4bda-abf5-85a8fed1bafb",
"alg": "RS256",
"n": "** public key in here **",
"e": "AQAB"
},
"[openIdServer + kid #2]": {
"use": "sig",
"kty": "RSA",
"kid": "e1583dde-e337-4bda-abf5-85a8fed1bafa",
"alg": "RS256",
"n": "** public key in here **",
"e": "AQAB"
}
} |
| This refers to the JWT (Json Web Token) that needs to be validated. |
| An optional map field to declare the claims as well as the corresponding value to validate against the token. |
| An optional field to verify the signing algorithm used by the token. The possible values could be RSA256, RSA384, RSA512, ECDSA256, ECDSA384, ECDSA512. By default, the APL function uses RSA256. |
Returns | An error message on validation failure. Null on validation success. |
Example - validateJwt
Example of the validateJwt function with optional values for claims and algorithm populated.
string token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Im5PbzNaRHJPRFhFSzFqS1doWHNsSFJfS1hFZyIsImtpZCI6Im5Pbz";
map<string, any> claimsToValidate = mapCreate(string, any);
mapSet(claimsToValidate, "appidacr", "2");
mapSet(claimsToValidate, "aud", "ae47e8fd-b2be-4626-a7b5-19d28961ba1e");
string error_message = JwtValidation.validateJwt("https://10.60.10.30/endpoint", token, claimsToValidate, "RSA512");validateAndDecodeJwt
Validates an incoming OAuth JWT with the error message and decoded payloads as return.
JwtValidationResult validateAndDecodeJwt(
string openIdServer,
string token,
map <string, any> claimsToValidate, //Optional
string algorithm //Optional)Parameters
Parameter | Description |
|---|---|
| This is the URL for the JWKS server. It stores the JWKS in the cache. Example - JWKS Cache The cache is accessible only from the backend and cannot be updated by users. It is used to reduce the number of connections to the {
"[openIdServer + kid #1]": {
"use": "sig",
"kty": "RSA",
"kid": "e1583dde-e337-4bda-abf5-85a8fed1bafb",
"alg": "RS256",
"n": "** public key in here **",
"e": "AQAB"
},
"[openIdServer + kid #2]": {
"use": "sig",
"kty": "RSA",
"kid": "e1583dde-e337-4bda-abf5-85a8fed1bafa",
"alg": "RS256",
"n": "** public key in here **",
"e": "AQAB"
}
} |
| This refers to the JWT (Json Web Token) that needs to be validated. |
| An optional map field to declare the claims as well as the corresponding value to validate against the token. |
| An optional field to verify the signing algorithm used by the token. The possible values could be RSA256, RSA384, RSA512, ECDSA256, ECDSA384, ECDSA512. By default, the APL function uses RSA256. |
Returns | An JwtValidationResult UDR which consists of error message on validation failure and decoded payloads. The error message will be Null on validation success. |
Example - validateAndDecodeJwt
Example of the validateAndDecodeJwt function with optional values for claims and algorithm populated.
string token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Im5PbzNaRHJPRFhFSzFqS1doWHNsSFJfS1hFZyIsImtpZCI6Im5Pbz";
map<string, any> claimsToValidate = mapCreate(string, any);
mapSet(claimsToValidate, "appidacr", "2");
mapSet(claimsToValidate, "aud", "ae47e8fd-b2be-4626-a7b5-19d28961ba1e");
JwtValidationResult result = (JwtValidationResult) JwtValidation.validateAndDecodeJwt("https://10.60.10.30/endpoint", token, claimsToValidate, "RSA512");
// To get the decoded payloads
map<string, any> claimsMap = result.claims;
debug(mapGet(claimsMap, "client_id"));
// To get the error message
debug(result.errorMessage);
This chapter includes the following section: