how to get KeyID (KID) in JWT

@Anonymous
I need to pass all the Header and Payload values as input parameters when calling a external Rest service

You mentioned 'It should be provided by the generator of the JWT' -> who or from where can I get this generator of JWT ? Do I need to call any external program, software or any tool to generate this and to validate ?

I am not sure from where do I get kid, iss, jti values to be pass in the header and payload.
Will this values be generated from any software, or will rest service client provide it to us. I only know these are dynamic values

Please advice

Hi, Let's start from the beginning.

• Are you generating the JWT token from your API side?
• If so, on what occasion do you create the JWT ? i.e. Authentication, Authorisation. etc
• Are you signing/encrypting this JWT token ?
• Let's say, you are generating the JWT because it is a requirement from the target (Ext Restful Service) API. In that case, when you pass this token with a request, who/what will validate this token ?
• How did you come to the conclusion regarding the required JWT token format ?

The reason behind the questions to understand your exact situation, then I can tell you whether you need to make up values and store them, retrieved from the JWt validator service in your case or simply ignore irrelevant payload and including header.

the target system uses an Authorization server to authenticate clients (our's) and provide an Access Token to invoke services.
The API client will obtain the Access Token from Target system's Authorization server.
The Target system follows JWT profile for OAuth 2.0 Client authentication and Authorization grants for issuing Access Token.

So to get this Access Token, we from our API side must first authenticate with the OAuth server to target systems endpoint.

It is my understanding To get this JWT.... we need to pass the Header, Payload and JWS

As I am new to this, trying to figure out step by step procedure in achieving this.

In that case, you should ask the target service stakeholders to provide required details to form the JWT token.

"The Target system follows JWT profile for OAuth 2.0 Client authentication and Authorization grants for issuing Access Token." - If this is the case, then the returned access token should be in the form of JWT and you just store the exact Access/Jwt token on your system (if it is server side then in cache, if it is on client side then in cookie) and pass it with consecutive requests.

I personally believe, the target service should provide the exact Jwt that they are going to authenticate against. This is to make sure clients/consumers are completely segregated from the auth processes and also to prevent accidental misconfigurations.

I will be very surprised if they provide access token as some sort of Guid string and ask you to create JWT on your own! You are the client system so all the pains and aches of token generations, validations, refresh etc should be taken care by the target system.

In summary,

• Mostly likely your API shouldn't be creating the JWT but receiving the token and passing it for consecutive requests
• If not, ask target system to provide all the details that "they" require to validate the token. You can easily create token on server side by using JWT client library. see: https://jwt.io/libraries

I hope this helps!

Yes when we send the JWT to the target system, we get Access_Token in response if it is successful.
For this Access_Token to get in response, we need to pass the Header and Payload in request.
And this JWT is unique in every call request we make.

the target system uses an Authorization server to authenticate clients (Souce system) and provide an Access Token to invoke services.
The source system will obtain the Access Token from Target system's Authorization server.
The Target system follows JWT profile for OAuth 2.0 Client authentication and Authorization grants for issuing Access Token.

In order to do that, Source system need to provide the following

1. URLs for signing and Encryption
   OpenId Connect well-known endpoint (OR)
   jwks and Issuer URLs
2. Authetication
   The network exposed APIs should be secured using either signed JWT, private key jwt or Access Token .
   Target system will provide client_id to be used in the APIs
3. Certificates
   We as source system should provide a certificate of issuing CAs for Authentication
   Private key may be stored in PEM file

there is an existing Authorization service which provided you with signing certificates? Iam trying to figure out how to generate the required JWT to obtain the Access Token?