Skip to content

Commit

Permalink
6689-Add section for Private Key JWT client authentication in OIDC cl…
Browse files Browse the repository at this point in the history
…ient docs-5

Add section for Private Key JWT client authentication in OIDC client docs -5

#6689
  • Loading branch information
ramkumar-k-9286 committed Jun 15, 2023
1 parent 6465af9 commit af61b8e
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -287,7 +287,7 @@ For more information, see xref:ROOT:authentication-filters.adoc[Authentication f
[#privatekey]
=== Use Private Key JWT for client authentication

OpenID Connect clients in Open Liberty support the `private_key_jwt` client authentication method with OpenID Connect token endpoints. OpenID Connect clients need to provide authentication data to the OpenID Connect provider for accessing the provider's token endpoint. Clients can authenticate by using several different methods, but most of those methods require a client secret. The `private_key_jwt` authentication method allows clients to use asymmetric keys to create signed JSON Web Tokens (JWTs) to authenticate instead of client secrets. By using this authentication method, OpenID Connect clients in Open Liberty no longer need to have a client secret.
OpenID Connect clients in Open Liberty support the `private_key_jwt` client authentication method with OpenID Connect token endpoints. OpenID Connect clients need to provide authentication data to the OpenID Connect provider for accessing the provider's token endpoint. Clients can authenticate by using several different methods, but most of those methods require a client secret. The `private_key_jwt` authentication method allows clients to use asymmetric keys to create signed JWTs to authenticate instead of client secrets. By using this authentication method, OpenID Connect clients in Open Liberty no longer need to have a client secret.

Server administrators can enable this function by using the `private_key_jwt` option for the `tokenEndpointAuthMethod` attribute, and the new `tokenEndpointAuthSigningAlgorithm` and `keyAliasName` attributes in the `openidConnectClient` element.

Expand All @@ -301,7 +301,7 @@ Server administrators can enable this function by using the `private_key_jwt` op
/>
----

The `tokenEndpointAuthSigningAlgorithm` attribute specifies the signing algorithm to sign the JWT that is used for client authentication.The `keyAliasName` attribute points to the private key to use to sign the JWT. The private key must be present in the keystore that is specified by the `sslRef` attribute in the config:openidConnectClient[display=OpenID Connect client configuration]. OpenID Connect providers that support Private Key JWT client authentication typically provide an interface for administrators to upload their corresponding public key.
The `tokenEndpointAuthSigningAlgorithm` attribute specifies the signing algorithm to sign the JWT that is used for client authentication. The `keyAliasName` attribute points to the private key to use to sign the JWT. The private key must be present in the keystore that is specified by the `sslRef` attribute in the config:openidConnectClient[display=OpenID Connect client configuration]. OpenID Connect providers that support Private Key JWT client authentication typically provide an interface for administrators to upload their corresponding public key.

For more information on `private_key_jwt` client authentication, see the https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication[OpenID Connect core specification] and https://datatracker.ietf.org/doc/html/rfc7523[RFC 7523].

Expand Down
2 changes: 1 addition & 1 deletion modules/reference/pages/feature/socialLogin/examples.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ The following example configures Instagram as the social media provider.
[#privatekeyjwt]
=== Use Private Key JWT for client authentication

OpenID Connect clients that are configured by using the `oidcLogin` element in the Social Media Login feature support the `private_key_jwt` client authentication method with OpenID Connect token endpoints. The process for enabling this support in the Social Media Login feature is identical to the feature:openidConnectClient[display=OpenID Connect Client 1.0] feature.
OpenID Connect clients that are configured by using the `oidcLogin` element in the Social Media Login feature support the `private_key_jwt` client authentication method with OpenID Connect token endpoints. The process for enabling this support in the Social Media Login feature is identical to the feature:openidConnectClient#privatekey[display=OpenID Connect Client 1.0] feature.

The following example shows how to use a private key JWT for client authentication.

Expand Down

0 comments on commit af61b8e

Please sign in to comment.