Decode json web token failure using signing key
Article ID: 259686
Updated On:
Products
Issue/Introduction
The policy contains the following flow:
1. Validate JSON access tokens issued by OKTA.
2. Retrieving the signing key from the authorization server API
3. Decode the JWT according to the documentation
https://techdocs.broadcom.com/us/en/ca-enterprise-software/layer7-api-management/api-gateway/10-1/policy-assertions/assertion-palette/message-validation-transformation-assertions/decode-json-web-token-assertion.html
If set assertion validation ‘none’ and just decode the JWT, it parses and get the expected output
{
type:JWS,
valid:,
payload:{"ver":1,"jti":"AT.EJU-Pq_RklWRsuvViwTgfAghegBOBAYgi6-h5-beQEc","iss":"https://dev.okta.com/oauth2/default","aud":"api://default","iat":1674675150,"exp":1674678750,"cid":"0oa7o0opseBIUZSu25d7","uid":"00u7nuwfwpfCBiH145d7","scp":["openid","testscope"],"auth_time":1674675147,"sub":"[email protected]"},
signature:Tlfd8zMIiWCux3r59H5Xy0cRPJFiaSfoGjdU3AX0hUkmsuHYn1oBY77zk5KgOK8S_olZNOdJtALcEiGp4LdfP88tzQORGe9LI7mdxNW3jzOBSaCbAxHBl2m9yf7AX5Z2pHBFWZlBmq_WMOm8QSMx3p0VOQlbgchit8ZYXzCExidZVeC7xbcfov3cYHUSy-dqR-LqYCBNqj-QFN-wC0illBVom-UH1RTDp0qb6rgwGjH21kOspCp74DoWk6OWrwoVJ_sjaCLhJc2UOvTGOlJVAyqswJ3xMgp1MaV2UgCzq03m64SYDlg2E3cW-y36HiubCEfvSAUS1iQ37nIZ1RL-SQ,
kid:CfK7CmupF48VWsQvHM3uBD2kBP6wqjN2u7R0dt-Bxsg
}
When setting validation to “use recipient key from context variable” and key type “JSON Web Key” with context variable holding the JWK as a string:
Decode / validation fails. The log shows the error messages:
2023-01-25T20:01:35.587+0000 WARNING 361 com.l7tech.external.assertions.jwt.server.ServerDecodeJsonWebTokenAssertion: 10805: JOSE Error: Error parsing JSON: null
2023-01-25T20:01:35.587+0000 WARNING 361 com.l7tech.external.assertions.jwt.server.ServerDecodeJsonWebTokenAssertion: 10802: Could not find the specified private key.
If using key type “JSON Web Key Set” and supplying context variable ${decode_result.header.kid} as Key ID
The log error message shows: "ServerDecodeJsonWebTokenAssertion: 10812: Key ID is required for retrieval of key from a JSON Web Key Set."
Environment
Release : 10.1
Cause
For the policy's Decode Json Web Token assertion: The source payload has KID in the header and The Recipient Key is a JWKS.
The Key Type should be "JSON Web Key Set" instead of "JSON Web Key". The Key ID field is required for JWKS.
The Decode assertion will try to convert the context variable from the Key ID field to a kid value.
If it is empty, the assertion will fail with the error message "Key ID is required for retrieval of key from a JSON Web Key Set."
In order to get the Key ID, it requires the Decode Json Web Token Assertion with Validation Method set to "None" to extract the header and payload and put the value into a context variable for the second assertion.
This is the expected behavior but it's inconvenient for the user because it should be able to extract it internally without another Decode assertion.
Resolution
Workaround:
Run the Decode Json Web Token assertion TWICE – once to decode only (validation = none) and THEN to validate - using the same token, it passes. It appears that the KID cannot be extracted from the JWT in the same pass when it is referenced in the decode.
Feedback
