How To: Enable JWT Encryption (JWE) for an OpenID Connect or OAuth 2.0 Realm

Version Affected: All

 

Overview

A SecureAuth Identity Platform client might include sensitive data in the JWT id_token that it wants to encrypt. While TLS encrypts the traffic in transit, mitigating most attack vectors, some scenarios call for additional privacy on the token's payload itself. JSON Web Encryption (JWE) encrypts just the JWT's payload.

Enable JSON Web Encryption (JWE)

The OAuth 2.0 or OpenID Connect (OIDC) client provides a URI enumerating its JSON Web Keys (JWKs). This URI must include a key with the attribute { "use": "enc" } for the encryption key, and the base64-encoded X.509 certificate must be provided in that key's { "x5c": "<encoded_cert_here>" } field. If it isn't, IdP silently fails the encryption and sends the token as cleartext base64 instead.

1. Go to the realm's Post Authentication tab, then Client > Client Details.
2. Set JSON Web Encryption to Enabled.
3. Enter the JSON Web Key URI the client provides.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.