The property allows the Public Verification Key text itself to be supplied as a string.

The property allows for an external or internal location of Public Verification Key to be specified. The value may be a relative path or a URL.

The configuration property allows for specifying which Public Key Signature Algorithm is supported by the MP JWT endpoint. This property can be set to either RS256 or ES256. Default value is RS256. Support for the other asymmetric signature algorithms such as RS512, ES512 and others is optional.

Configuration key for expected issuer of incoming tokens.

Configuration key for expected audiences of incoming tokens.

Max number of seconds since token issue time. If this number of second accedes configured value, validation will fail.

Number of seconds for the clock skew during the token age verification and expiry.

Cookie property name which is expected to contain a JWT token.

Header name which is expected to contain a JWT token.

The property allows for an external or internal location of Private Decryption Key to be specified. The value may be a relative path or a URL.

The configuration property allows for specifying which key management algorithm is supported by the MP JWT endpoint. Supported algorithms are either RSA-OAEP or RSA-OAEP-256. If no algorithm is set, both algorithms must be accepted.

If set to true, failure to authenticate will return ABSTAIN result instead of FAILURE. This is an important distinction when more than one provider is used

Whether to attempt authentication

Whether to attempt identity propagation/JWT creation

Whether we authenticate a user or a service (other option is SERVICE)

A group for configuring authentication of the request

Whether to verify signature in incoming JWT. If disabled, ANY JWT will be accepted

Expected audience of the JWT. If not defined, any audience is accepted (and we may accept JWT not inteded for us)

Configuration of the JWK to obtain key(s) to validate signatures of inbound token. The JWK should contain public keys.

A handler configuration for inbound token - e.g. how to extract it

Name of a header the token is expected in

Prefix before the token value (optional)

Regular expression to obtain the token, first matching group is used (optional)

A group for configuring outbound security

Configuration of the JWK to use when generating tokens (follows the same rules as atn-token.jwk above). The JWK must contain private keys when using asymmetric ciphers.

When we issue a new token, this is the issuer to be placed into it (validated by target service)

A group for configuring outbound rules (based on transport, host and.or path)

A short descriptive name for configured target service(s)

An array of transports this outbound matches (e.g. https)

An array of hosts this outbound matches, may use * as a wild-card (e.g. *.oracle.com)

An array of paths on the host this outbound matches, may use * as a wild-card (e.g. /some/path/*)

Configuration of outbound token handler (same as atn-token.handler)

Java text format for generating the value of outbound token header (e.g. "bearer %1$s")

If this key is defined, we are generating a new token, otherwise we propagate existing. Defines the key id of a key definition in the JWK file to use for signing the outbound token

A key to use in the generated JWT - this is for the other service to locate the verification key in their JWK

Audience this key is generated for (e.g. http://www.example.org/api/myService) - validated by the other service

Makes this key valid this amount of seconds into the past. Allows a certain time-skew for the generated token to be valid before current time (e.g. when we expect a certain misalignment of clocks)

Token validity in seconds