Hi Debjit
I am unclear on how the VerifyJWT Policy can use the proxy from Step 1. The policy has options to pass a static uri or an uriRef, but am unclear on how the policy can leverage this proxy.
If I understand what you've done, you have a proxy that accepts a request like
https://test.auth.highmark.com/jwks-getter?domain=apigee-demo-apim
That's a static URL. You can just use that directly in your VerifyJWT policy.
<VerifyJWT continueOnError="false" enabled="true" name="JWT-VerifyJWKS">
<DisplayName>JWT-VerifyJWKS</DisplayName>
<Algorithm>RS256</Algorithm>
<!-- <Source>request.header.authorization</Source> -->
<PublicKey>
<JWKS uri="https://test.auth.highmark.com/jwks-getter?domain=apigee-demo-apim"/>
</PublicKey>
</VerifyJWT>
If you are thinking that you need to support. multiple different oauth domains with the same policy, that means you need to have a dynamic (determined at runtime) uri. In that case you can set a variable, and use uriRef. Set the variable in a policy like
<AssignMessage name='AM-OAuth-JWKS-URI'>
<IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
<AssignVariable>
<Name>oauth_domain_fulluri</Name>
<Template>https://test.auth.highmark.com/jwks-getter?domain={desired_oauth_domain}</Template>
</AssignVariable>
</AssignMessage>
And then the VerifyJWT would be like this;
<VerifyJWT continueOnError="false" enabled="true" name="JWT-VerifyJWKS">
<DisplayName>JWT-VerifyJWKS</DisplayName>
<Algorithm>RS256</Algorithm>
<!-- <Source>request.header.authorization</Source> -->
<PublicKey>
<JWKS uriRef="oauth_domain_fulluri"/>
</PublicKey>
</VerifyJWT>
Also, let me clarify what I said earlier
Embed the Identity domain name as a path segment, rather than a header.
I was suggesting a Path segment, not a query param. So the inbound URL would look like
https://test.auth.highmark.com/oauth2/apigee-demo-apim/.well-known/jwks
And in the jwks wrapper proxy, you would use ExtractVariables to extract the path segment. Like this:
<ExtractVariables name='EV-OAuth-Domain'>
<Source>request</Source>
<VariablePrefix>extracted</VariablePrefix>
<URIPath>
<!-- put the extracted value into extracted.oauth_domain -->
<!-- NB: The Pattern is matched against pathsuffix (what comes AFTER the basepath) -->
<Pattern ignoreCase='false'>/{oauth_domain}/.well-known/jwks</Pattern>
</URIPath>
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
</ExtractVariables>
And then you have a variable extracted.oauth_domain , holding the value that you could set into the required header, X-OAUTH-IDENTITY-DOMAIN-NAME , with an AssignMessage.
THIS WILL WORK. Your query param approach will work, too, though it feels slightly less elegant to me.
But if I were the IDP architect on this system, I would want to avoid the wrapper proxy entirely. Ideally, the JWKS endpoint should not require that header. The JWKS should "natively" extract the domain from a URL path. Wrapping an Apigee proxy around that endpoint as a wrapper, helps, but the ideal solution would be to modify that JWKS endpoint at the source. I understand that might not be quickly feasible!
LinkedIn
Twitter
