Today, you cannot configure the VerifyJWT policy to perform a "partial match" on a string claim.
For example, you cannot configure the policy to check for the substring "xxxxx" (or any substring) in a claim named "scope".
In the case that the scope claim holds a string value that is a set of substrings separated by whitespace, the claim value is still a simple string.
YOU CAN configure a condition outside the VerifyJWT policy, to check for a partial match on one of the claim values. When VerifyJWT runs, it sets variables containing the values of the various claims. Supposing a JWT payload like this:
{
"iss": "https://d10l.eu.auth0.com/",
"sub": "auth0|5a70e4e394059f5e7527d6b1",
"aud": [
"https://api.d10l.de",
"https://d10l.eu.auth0.com/userinfo"
],
"iat": 1518429498,
"exp": 1518436698,
"azp": "94YJaDlR5QDpaS7Em6aC02_gj6kA1Q_G",
"scope": "openid profile https://api.d10l.de/products:write https://api.d10l.de/products:read"
}
You could use this Verify policy to check audience and issuer and subject if you like:
<VerifyJWT name="Verify-JWT-2">
<Algorithm>HS256</Algorithm>
<Source>request.formparam.jwt</Source>
<SecretKey>
<Value ref="private.secret_key"/>
</SecretKey>
<Subject>auth0|5a70e4e394059f5e7527d6b1</Subject>
<Issuer>https://d10l.eu.auth0.com/</Issuer>
<Audience>https://api.d10l.de</Audience>
</VerifyJWT>
(NB: The audience is treated specially as the claim value is potentially an array. This policy config checks that the specified audience is one of the elements of the array.)
THEN, immediately after that policy, you could use a regex check, and raise a fault if it fails. Like this:
<Request>
<Step>
<Name>Verify-JWT-2</Name>
</Step>
<Step>
<Condition>NOT (jwt.Verify-JWT-2.claim.scope ~~ ".*\bhttps://api.d10l.de/products:read\b.*")</Condition>
<Name>RF-MissingScope</Name>
</Step>
</Request>
That little bit of hieroglyphics with the double twiddle is a regex match. The pattern says "look for the string https://api.d10l.de/products:read bounded by non-word characters (like space or end-of-string or beginning-of-string)".
The ~~ operator in Apigee Edge matches on the entire string, so you need the .* at the beginning and the end of the pattern to slurp up any potential other characters.
If the claim really IS an array value, then you can do the checking inside the policy. Specifically, if the JWT looks like this:
{
"aud": ["https://api.d10l.de", "https://api.d10l.de"],
"sub": "auth0|5a70e4e394059f5e7527d6b1",
"nbf": 1518751495,
"azp": "94YJaDlR5QDpaS7Em6aC02_gj6kA1Q_G",
"scope": ["openid", "profile", "https://api.d10l.de/products:write", "https://api.d10l.de/products:read"],
"iss": "https://d10l.eu.auth0.com/",
"exp": 1518780295,
"iat": 1518751495
}
...then you can verify the presence of any a specific string as a member of the scope claim using this policy configuration:
<VerifyJWT async="false" continueOnError="false" enabled="true" name="Verify-JWT-1">
<Algorithm>HS256</Algorithm>
<Source>request.formparam.jwt</Source>
<SecretKey>
<Value ref="private.secret_key"/>
</SecretKey>
<Subject>auth0|5a70e4e394059f5e7527d6b1</Subject>
<Issuer>https://d10l.eu.auth0.com/</Issuer>
<Audience>https://api.d10l.de</Audience>
<AdditionalClaims>
<Claim name="scope" type="string" array="true">https://api.d10l.de/products:read</Claim>
</AdditionalClaims>
</VerifyJWT>
And in that case you don't need an extra Condition and RaiseFault.
Clear?
LinkedIn
Twitter
