I have currently setup different algorithms for my Auth Code Flow token and my Client Credentials token. The Setup I did to verify this in Apigee is
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyJWT async="false" continueOnError="false" enabled="true" name="Verify_JWT">
<DisplayName>Verify_JWT</DisplayName>
<FaultRules/>
<Properties/>
<Algorithm>RS512,PS256</Algorithm>
<IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
<Issuer>https://auth.example.com</Issuer>
<PublicKey>
<JWKS uri="https://auth.example.com/pf/JWKS"/>
</PublicKey>
<Source>inbound.jwt</Source>
</VerifyJWT>
It is sometimes working well for a client credential flow (using RS512) but sometimes it fails with invalid token. According to my understanding of the documentation a token should be validated against both these algorithms. Is that an incorrect assumption? What is the best way to make it validate against both ?
User | Count |
---|---|
1 | |
1 | |
1 | |
1 | |
1 |