Taking this question from the previous comment thread.
"Did the extract variables in the shared flow worked for you. As per apigee docs, extract from JSONPayload only works for "Content-Type header is application/json." But in case of JWT the header content is not json. Any inputs on how this extract variables can be achieved."
Not sure I understand the question. Here is what I think you may be referring to.
The sample project is setup up to test the Java callout with various inputs. The test cases are varied based on contents of JSON object in the request body and the same is used to configure the Java callout.
On a production bound Java callout for JWT validation, configuration information like Issuer, Audience, Keys, Algos, etc. should come from an encrypted KVM. This way you can separate config from code, separate different environment values from each other and keep secrets and keys protected.
So instead of an ExtractVariables policy, in your case you would use a KeyValueMapOperations policy to read KVM entries for what to verify in the JWT Java callout. You could also hard code these values in Java callout, to begin with.
The JWT itself can come from the Authorization header. You can use ExtractVariables to get it from header.
<Header name="Authorization">
<Pattern ignoreCase="true">Bearer {jwt}</Pattern>
</Header>
Hope this helps.
LinkedIn
Twitter
