JWT utility

Use this utility to issue JWT or validate JWT.
To use this utility, add this line at the beginning of your JavaScript:

importClass(Packages.com.tivoli.am.fim.fedmgr2.trust.util.LocalSTSClient);

1. Issuing a JWT

To issue a JWT, call the following method:

  var result = JwtUtility.issueJWT(settings, claims, headers);

1.1. JwtIssuerSettings

This class is a setting builder when a JWT is issued.

The following example shows how to create the JwtIssuerSettings object.

  var settings = new JwtIssuerSettings()
    .signAlgorithm("ES256")
    .signUseAsymmetricKey("rt_signstore", "server")
    .encryptAlgorithm("RSA-OAEP-256", "A256GCM")
    .encryptUseAsymmetricKey("rt_encryptstore", "client01rsa")
    .encryptUseCompression()
    .setSubject("US2FQSHNFE")
    .setIssuer("https://www.myidp.com")
    .setAudience(["client01", "https://resource.com"])
    .generateJTI()
    .setLifetimeInSeconds(3600);

1.2. JwtIssuerResult

This class represents the response from JWT issuer.

2. Validating a JWT

To validate a JWT, call this method:

  var result = JwtUtility.validateJWT(settings, jwt);

2.1. JwtValidatorSettings

This class is a settings' builder when a JWT is validated.

The following example shows how to create the JwtValidatorSettings object:

  var settings = new JwtValidatorSettings()
    .verifyUseAsymmetricKeyStore("rt_signstore", false)
    .verifyUseSymmetricKey("secret")
    .decryptUseAsymmetricKeyStore("rt_encryptstore")
    .decryptUseSymmetricKey("secret", true)
    .withJwksUri("https://some.org/jwks");

2.2. JwtValidationResult

This class represents the response from JWT validator and offer methods that can be used to validate claims in the JWT.

2.3. JWT types

The system currently uses the following Jwt types. For custom type, use value 10 and higher.

3. Supported algorithms