OAuth Policy to Generate and Validate the oauth JWT Token

Google Cloud Apigee
, , , , ,
1

Hi Team

We are using below operation to generate the token using Oauth2.0 Policy

GenerateJWTAccessToken client_credentials RS256 3600000

and the Verify we are using

VerifyJWTAccessToken RS512

So may question is can we generate the “GenerateJWTAccessToken” with custom claims as we can do in generateJWT policy, Also can we validate custom claims as well in VerifyJWtAccessToken in OAuthv2.0 policy.

Please provide some guidance here :slightly_smiling_face:

@dchiesa1

1 Like
2

No; you cannot add custom, arbitrary claims to a token generated in that way.

If you want to include custom arbitrary claims, then I suggest that you do not use the OAuthV2 policy. Instead:

  • GenerateJWT for generation, and add in the client_id of the calling app, as well as any custom claims
  • VerifyJWT for verification + VerifyAPIKey on the client_id.