JWT Functions

Overview

Allows for an additional layer of security using signed JWT. This plug-in may also be used to integrate with external systems using JWS.

Key Functionality and Features

jwtsign - Create a signed JWT using HS256, HS384, HS512, ES256, ES384, ES512, RS256, RS384, or RS512
jwtverify - Verify signed JWT
jwtgeneratesecretkey - Generate an Hmac-SHA key that can be used to sign a JWT using HS* algorithm
jwtdecode - Decode a JWT without verifying the signature

Uses JWTKs JJWT library: https://github.com/jwtk/jjwt

davidJimenez 1 month ago

When using de the jwtdecode function, it works properly, but we see this error in Appian logs.

2023-02-10 09:15:43,868 [Appian AppianServerThreadPoolProvider 6155287] ERROR com.appiancorp.type.handlers.BooleanHandler - Expected 1L or 0L but got: false
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Appian AppMarket 5 months ago
v2.0.1 Release Notes
- Updated plugin dependency to resolve vulnerability findings:
- CVE-2022-42003
- CVE-2022-42004
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Appian AppMarket 10 months ago
Release Notes - v2.0.0
- Added support for JWKS
- JWKS Uri will be derived from the token's issuer field concatenated with jwksPath from DecodeOptions
New Decode Options:
- jwksPath - Path to be appended in the issuer field to retrieve the JWKS
- jwksUri - Override the entire Jwks Uri, if the URI is completely different from the issuer field
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Appian AppMarket 10 months ago
v1.2.0 Release Notes
- Security fix - update library dependencies
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
jraquino 10 months ago in reply to chandhinir0002

Thanks for the feedback, I'll look into updating the library version
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
chandhinir0002 10 months ago

Hi,

We are facing some vulnerability issue while scanning this plugin. Kindly help to check.

Issue:

jackson-databind before 2.13.0 allows a stack overflow exception and denial of service via a large depth of nested objects.

Thanks in advance!
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
oha-dexter-b over 1 year ago in reply to jraquino

That worked. Thanks!

I'd be very curious on why named-parameters don't work. Let me know if you get time to look into that.
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
jraquino over 1 year ago in reply to oha-dexter-b

I think it has something to do with using key-based function call - I'm not sure if this is fully supported by plugin functions.

Can you try using order-based function call shown below?

Thanks
- Cancel
- Up +1 Down
- Reply
- More
- Cancel
oha-dexter-b over 1 year ago
Hey, for some reason I am unable to set reserved keys in the payload, and then when using TokenOptions for jwtverify options it still does not seem to add them:
```
eyJhbGciOiJIUzI1NiJ9.eyJwYXkiOiJsb2FkIiwiaWF0IjoxNjQ3OTQwNjg1fQ.-deGIDlA2fC3NnBbl3yqLI_ODHgel8QzTfXzpc7aiQg
```
Any ideas why this is not working?
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Appian AppMarket over 1 year ago
Release Notes - v1.1.1
- Security Updates
- Cancel
- Up 0 Down
- Reply
- More
- Cancel