Question about VerifyJWT policy

[soupfrequent123]

We are using the VerifyJWT policy to decrypt the content . This is our current configuration below:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyJWT continueOnError="false" enabled="true" name="VJWT-policy">
<DisplayName>VJWT-policy</DisplayName>
<Algorithms>
<Key>ECDH-ES+A256KW</Key>
</Algorithms>
<Source>variable_containing_the_jwe</Source>
<PrivateKey>
<Value ref="private.encryption-key"/>
</PrivateKey>
</VerifyJWT>

We ensure that all of our steps before this are correct and we verify most on the requirements are met. 

I have verified the keys used on this process for both the public/private key using an online jwt tool and I am able to decrypt/verified it properly. But in Apigee we are getting this InvalidToken error and this is an error from the debug: Payload of JWE object is not a valid JSON object

Anyone has verified/decrypt a ECDH-ES+A256KW before? 

Thanks!

[dchiesa1 · Accepted solution]

Have you seen this question?

Maybe you two are working together? 

The short answer is Apigee's builtin policies handle encrypted JWT, but not the general case of JWE, at this time. 

If you want the general case of JWE, you need to resort to a Java callout. 

See the answer linked to the Q above for more details.

[soupfrequent123]

Ahh yes this is similar. I'll just reply from that thread. But yes upon checking VerifyJWT does not support yet the general decryption at the moment. So we will use an OOB for this maybe a cloud function to do the decryption/decoding of the token. Thanks!