Skip to content

Commit

Permalink
edits per peer review
Browse files Browse the repository at this point in the history
  • Loading branch information
dmuelle committed Oct 26, 2023
1 parent dea3045 commit 0ac2061
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions modules/ROOT/pages/json-web-token.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -33,14 +33,14 @@ When the `jwkEnabled` attribute for the `jwtBuilder` element is set to `true` in

A new key is generated when the JWT builder creates the first token, or when the JWK endpoint for the builder is invoked, whichever happens first. After creation, the key is rotated automatically every 12 hours.

Dynamically generated JWKs are useful if you do not want to set up a keystore and signing key for the JWT builder. When you set the `jwkEnabled` attribute to `true`, Open Liberty handles the creation and maintenance of the key. Therefore, when you set `jwkEnabled` to `true`, any `keyStoreRef` and `keyAlias` attributes that are specified in the `jwtBuilder` element are ignored, as shown in the following example:
Dynamically generated JWKs are useful if you do not want to set up a keystore and signing key for the JWT builder. When you set the `jwkEnabled` attribute to `true`, Open Liberty handles the creation and maintenance of the key. Therefore, when you set the `jwkEnabled` attribute to `true`, any `keyStoreRef` and `keyAlias` attributes that are specified in the `jwtBuilder` element are ignored, as shown in the following example:

[source, xml]
----
<jwtBuilder id="myBuilder" jwkEnabled="true" keyStoreRef="myRef" keyAlias="myAlias" />
----

In this example, the `keyStoreRef` and `keyAlias` values are ignored and the dynamically generated JWKs are used instead.
In this example, the `keyStoreRef` and `keyAlias` attribute values are ignored and the dynamically generated JWKs are used instead.

JWKs that are dynamically generated are lost if the Open Liberty server restarts because these keys are stored only in memory. Dynamically generated JWKs cannot be shared between Open Liberty servers. If your Open Liberty server runs in a cluster environment and you need to build JWTs, consider using static JWKs instead.

Expand Down Expand Up @@ -77,9 +77,9 @@ In this case, the JWK endpoint for the JWT builder (`\https://<host>:<port>/jwt/

=== Verify JWTs with JWKs

Regardless of whether JWKs are dynamically created or static, JWT consumers can retrieve JSON Web Key Set (JWKS) documents to reconstruct public keys to verify token signatures. JWKS documents are useful for JWT consumers that receive tokens from issuers that frequently rotate their signing keys, and for server administrators who do not want to manually maintain a keystore.
Regardless of whether JWKs are dynamically created or static, JWT consumers can retrieve JSON Web Key Set (JWKS) documents to reconstruct public keys and verify token signatures. JWKS documents are useful for JWT consumers that receive tokens from issuers that frequently rotate their signing keys, and for server administrators who do not want to manually maintain a keystore.

To configure Open Liberty to verify token signatures with JWKs, set the `jwkEnabled` attribute in the `jwtConsumer` element to `true`. Also, you must set the `jwkEndpointUrl` attribute to a URI that provides the JWKS document that contains the public keys to verify the signatures of the tokens that received by this JWT consumer.
To configure Open Liberty to verify token signatures with JWKs, set the `jwkEnabled` attribute in the `jwtConsumer` element to `true`. Also, you must set the `jwkEndpointUrl` attribute to a URI that provides the JWKS document that contains the public keys to verify the signatures of the tokens that are received by this JWT consumer.

[source, xml]
----
Expand Down

0 comments on commit 0ac2061

Please sign in to comment.