Testing the client authentication using client assertion in Symantec Identity Security Platform / Auth Hub

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Procedure to test the client credentials grant using client assertion in Symantec Identity Security Platform (VIP Authentication Hub).

Environment

Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Resolution

Procedure to test the client authentication using client credential grant and client assertion:

1. Configure the application in admin console.
   
   * Enable the OAuth/OpenId feature
   * Configure the Client Type as Trusted with the certificate
   
   
   
   
2. Obtain the elements to generate the Client Assertion:
   
   * Using certutil command, collect the values for the parameters kid, Cert Hash (sha1) and Cert Hash (sha256).
   
   
   
   x5t - Base64 of 'Cert Hash(sha1)' - NmxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxMg==
   x5t#S256 - Base64 of 'Cert Hash(sha256)' - YzxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxMQ==
   kid - 10xxxxxxxxxxxxxxxxxxxxb6
   
   * The payload parameters are either related to the certificate issuer (iss), the application itself (sub as the client id), specific to this token (jti), or time related (exp, nbf, iat).
   aud - https://${SSP_FQDN}/default/
   
   
3. Prepare the header and payload to generate the client assertion.
   
   
   
   
4. Generate the Client Assertion using https://www.jwt.io/ - JWT Encoder.
   
   
   
   
5. Test the client authentication using the generated Client Assertion.
   
   
   
   

 

Additional Information

Refer the sections Client Credential Grant and Client Assertion for more information.