JWT Configuration

Configuration Options

MicroProfile configuration options:

key	type	description
`mp.jwt.verify.publickey`	string	The property allows the Public Verification Key text itself to be supplied as a string.
`mp.jwt.verify.publickey.location`	string	The property allows for an external or internal location of Public Verification Key to be specified. The value may be a relative path or a URL.
`mp.jwt.verify.publickey.algorithm`	string	The configuration property allows for specifying which Public Key Signature Algorithm is supported by the MP JWT endpoint. This property can be set to either `RS256` or `ES256`. Default value is `RS256`. Support for the other asymmetric signature algorithms such as `RS512`, `ES512` and others is optional.

Optional configuration options:

key	type	default value	description
`optional`	boolean	`false`	If set to `true`, failure to authenticate will return `ABSTAIN` result instead of `FAILURE`. This is an important distinction when more than one provider is used
`authenticate`	boolean	`true`	Whether to attempt authentication
`propagate`	boolean	`true`	Whether to attempt identity propagation/JWT creation
`principal-type`	string	`USER`	Whether we authenticate a user or a service (other option is SERVICE)
`atn-token`	string	A group for configuring authentication of the request
`atn-token.verify-signature`	boolean	`true`	Whether to verify signature in incoming JWT. If disabled, ANY JWT will be accepted
`atn-token.jwt-audience`	string		Expected audience of the JWT. If not defined, any audience is accepted (and we may accept JWT not inteded for us)
`atn-token.jwk.resource.*`	string		Configuration of the JWK to obtain key(s) to validate signatures of inbound token. The JWK should contain public keys. This may be: jwk.resource.path, jwk.resource.resource-path, jwk.resource.url, jwk.resource.content-plain (actual JSON string), jwk.resource.content (base64)
`atn-token.handler`	string	`Authorization` header with `bearer ` prefix	A handler configuration for inbound token - e.g. how to extract it
`atn-token.handler.header`	string		Name of a header the token is expected in
`atn-token.handler.prefix`	string		Prefix before the token value (optional)
`atn-token.handler.regexp`	string		Regular expression to obtain the token, first matching group is used (optional)
`sign-token`	string		A group for configuring outbound security
`sign-token.jwk.resource.*`	string		Configuration of the JWK to use when generating tokens (follows same rules as atn-token.jwk above), this JWK must contain private keys when using asymmetric ciphers
`sign-token.jwt-issuer`	string		When we issue a new token, this is the issuer to be placed into it (validated by target service)
`sign-token.outbound`	string		A group for configuring outbound rules (based on transport, host and.or path)
`sign-token.outbound.*.name`	string		A short descriptive name for configured target service(s)
`sign-token.outbound.*.transports`	string	any	An array of transports this outbound matches (e.g. https)
`sign-token.outbound.*.hosts`	string	any	An array of hosts this outbound matches, may use * as a wild-card (e.g. *.oracle.com)
`sign-token.outbound.*.paths`	string	any	An array of paths on the host this outbound matches, may use * as a wild-card (e.g. /some/path/*)
`sign-token.outbound.*.outbound-token`	string	`Authorization` header with `bearer ` prefix	Configuration of outbound token handler (same as atn-token.handler)
`sign-token.outbound.*.outbound-token.format`	string		Java text format for generating the value of outbound token header (e.g. "bearer %1$s")
`sign-token.outbound.*.jwk-kid`	string		If this key is defined, we are generating a new token, otherwise we propagate existing. Defines the key id of a key definition in the JWK file to use for signing the outbound token
`sign-token.outbound.*.jwt-kid`	string		A key to use in the generated JWT - this is for the other service to locate the verification key in their JWK
`sign-token.outbound.*.jwt-audience`	string		Audience this key is generated for (e.g. http://www.example.org/api/myService) - validated by the other service
`sign-token.outbound.*.jwt-not-before-seconds`	string	`5`	Makes this key valid this amount of seconds into the past. Allows a certain time-skew for the generated token to be valid before current time (e.g. when we expect a certain misalignment of clocks)
`sign-token.outbound.*.jwt-validity-seconds`	string	1 day	Token validity in seconds