Allow customization of audience when using private_key_jwt as authentication method when making a OAuth 2.0 token exchange call

[Jasper Visser]

We are using:

• Layer7 API Gateway - Policy Manager 11.1.3.21907
• Layer7 DMZ API tenant 5.3.1

We want to allow users to authenticate with private_key_jwt while doing a token exchange. One of the mandatory fields is the users has to include in the JWT is the aud claim. We are hoping we can customize the accepted values of that, because currently only the internal hostname is allowed by the validations in OTK Client JWT Validation in the Policy Manager.

Users are requesting a token exchange from URL https://<our-domain>/auth/oauth/v2/token while the aud claim must be: https://<host-of-layer7-gateway>:<port>/auth/oauth/v2/token. We are hoping we can use the first URL in the aud claim and without the port so its consistent and we don't have to expose internal hostnames and ports to the client.

Is this possible in newer versions, on the roadmap or not planned at all? I don't see any customization block available to overwrite the audience.

[Abhishek Subramanya]

Hi Jasper,

           Please can you share the version of OTK installed in your Gateway? You can find it by going to Tasks -> Extensions & Add Ons -> Manage Solution Kits. We dont have a customization at this place. But the audience is set within the endpoint - auth/oauth/v2/token which is editable. You can update the ${token_endpoint} variable with the domain name based url? I have put a snapshot below where you can find the exact policy line. 

[Remco Dekker]

Hi Jasper,

Please check the settings for OAuth2 Audience Restriction (the check is by default not mandatory).

Also, because you mention only the internal hostname is allowed, check the settings for Host Pages on External Servers. By default this setting take over the hostname from ${gateway.cluster.hostname}, which in your case will be the internal hostname I guess. The  #OTK Authorization Server Configuration policy will allow you to override this (of course setting the cluster.hostname can also do this, but you should check side effects as this is more generally used in cases).

See also: Token Exchange Grant and especially #OTK Validate Token Exchange Audience And Scope for the customization policy for validating audience and scope.

Only the OAuth Manager or DCR will allow client registration with private_key_jwt.

Remco

[Jasper Visser]

Hi @Abhishek Subramanya,

We are running version OAuthSolutionKit 4.6.2-7680.

Updating the token_endpoint variable is one option, but we prefer a customization point where we can change the token_endpoint once and don't have to worry when updating the toolkit to remember updating that variable again and again. We are happy there are so many customization points available for other use cases, is it an option to include one somewhere so we can override it? Or do I have to issue a feature request elsewhere? The returned value for key 'resource' in the clientResponse also returns the internal hostname which is not desired.

[Jasper Visser]

Hi @Remco Dekker,

I think there is a bit of a misunderstanding. Currently the default setting is that only the internal hostname is accepted as aud claim for external clients. This is what we do NOT want.

We want to use the public facing domain accepted as aud claim (https://mydomain.nl), not the internal hostname (https://internal.domain:8443). 

I think the mentioned audience links are related to other functionality and not specifically for the aud claim.

[Abhishek Subramanya]

@Jasper Visser,

                       The token_endpoint variable is derived from oauth2_server_hostname variable which is defined in OTK Variable Configuration. You can customize this variable in #OTK Variable Configuration.

[Jasper Visser]

Goodmorning @Abhishek Subramanya, I can try customizing that, but than we still are forced to include a port because the ':' is already in the url which can not be removed by customization.

We will be exposing the final required aud claim to a lot of businesses and we are hoping to omit the portnumber as well.

[Abhishek Subramanya]

@Jasper Visser

    Yes, I agree the port needs to be set with this customization.  I will provide this feedback to the team & get it added to the backlog. Please can you open a case with reference to this thread. I cannot guarantee whether this will be included in the next release. But it will be considered in future work.

[Jasper Visser]

@Abhishek Subramanya thanks for putting it on the backlog. Remco opened the case for us through EnableU. Hopefully it gets fixed in the near future :)