JSON Web Key Set (JWKS)

2. JSON Web Key Set (JWKS) Settings

In IBM Security Verify Access, the user is allowed to create multiple keystores to arrange their personal or signer keys.

For IBM Security Verify Access OIDC provider implementation, use the following settings:

• Create two keystores - one contains keys that are related to JWT signing and the other contains keys that are related to JWT encryption. Read about key management.
• Specify the keystore names in the signing_keystore and encryption_keystore
• Public key of personal keys under the signing_keystore/personal is published in /jwks endpoint with use=sig
• Public key of personal keys under the encryption_keystore/personal is published in /jwks endpoint with use=enc

Apart from the usage shown above, signing_keystore and encryption_keystore are used as the default keystore to validate request object if jwks_uri is not configured and to encrypt the outgoing JWT if the configuration is missing. To validate this JWT, the system looks for signer key under signing_keystore with the same name that matches the kid header.

jwks:                                                       # JSON Web Key Set (JWKS) Settings
  signing_keystore: signing_keystore                         # Keystore name containing keys related to JWT signing/signature validation.
  encryption_keystore: encryption_keystore                      # Keystore name containing keys related to JWT encryption/decryption.