This section provides instructions on how to get the user claims of the authorized user as a JWT token with the validation response.
<IS_HOME>/repository/conf/identity/identity.xmlfile and set the
<Enabled>element (found under the
<OAuth>,<AuthorizationContextTokenGeneration>elements) to true as shown in the code block below.
Note: By default, the user claims are retrieved as an array. To retrieve the claims as a string instead of an array, add the following property under the
<AuthorizationContextTokenGeneration>tag in the
The following configurations are optional and can be configured as needed.
See the Extension Points for OAuth topic for more details about the usage of the '
TokenGeneratorImplClass' and '
ConsumerDialectURI: Defines the URI for the claim dialect under which the user attributes need to be retrieved.
SignatureAlgorithm: Defines the algorithm to be used in signing the payload that carries user claims. If you want to disable signing of the JWT token, set this element to "NONE".
AuthorizationContextTTL: Defines the expiry time for JWT token in minutes.
Retrieving user claims with the JWT
User claims can be retrieved using the ID token or the userinfo endpoint. For more information, see Basic Client Profile with Playground.
You can access the userinfo endpoint with the received access token using the following curl command. As per the specification, the received bearer token is sent using the HTTP Authorization header.
As the response, WSO2 Identity Server returns a JSON with user claims.
The signature verification can be done similar to the ID token signature verification.
The portions of each token are separated by the full stop. To see the exact JSON values, do a Base64 decode for
If the unsigned ID token contains only 2 portions:
If the signed ID token contains 3 portions:
Validating the ID token signature
The following code segment is a simple Java program that can be used to validate the ID token signature against the default
wso2carbon.jks public key in WSO2 products.