JWT

Overview

Generate and validate JSON web tokens for use in integrating and authenticating with external systems, using a JWKS registry to get public keys for token signature validation. The create token functions support encrypted private keys in either the PKCS#1 or PCKS#8 standard.

Key Features & Functionality

  • createtoken (Function) - create a signed JSON web token with standard claims.
  • createtokenwithcustomclaims (Function) - create a signed JSON web token with standard claims and additional custom claims that may be required for authentication with specific systems.
  • validatejwtsignature (Function) - Verify a received token against the issuing system's public key. Supports tokens encrypted with the RSA256 and RSA512 algorithm. Returns true if token was verified.
  • decodeJWT (Function) - Given a JWKS registry URL and a token, retrieve the proper public key and validate the given token returning an string with the decoded token if signature is valid, null otherwise
  • createDocuSignRSAJWTToken (Function) - Generates a JWT that conforms to the specs of DocuSign.
Anonymous
Parents
  • Hello Will,

    Great that you like it, and happy to help here. The GUID in itself should not be the problem, I am using similar GUID in my own use case. are you perhaps passing this value into the exp field? Or, what might be the case, did you not include the exp (with a null value) in your call? Plugins will not handle named parameters as you expect them. It will simply map each parameter based on order and ignore the naming you specified. If you omitted exp: null in your call, it will think the value you entered for sub should go for the exp parameter, which expects an int, not a string.

Comment
  • Hello Will,

    Great that you like it, and happy to help here. The GUID in itself should not be the problem, I am using similar GUID in my own use case. are you perhaps passing this value into the exp field? Or, what might be the case, did you not include the exp (with a null value) in your call? Plugins will not handle named parameters as you expect them. It will simply map each parameter based on order and ignore the naming you specified. If you omitted exp: null in your call, it will think the value you entered for sub should go for the exp parameter, which expects an int, not a string.

Children
  • It works now! Thanks a lot for your help .

  • Close! Below is what my setting looks like. You only want to have the Private Key in that field, not the public and private.

  • Ah okay, I have added JWT. My key in the credentials is named appianprivatekey with both the public and private keys pasted as the values. Is this the correct way to do it? Because currently I'm getting "Appian JWTTools failed to generate JWT Token". Thanks!

  • You need to 'allow' the plugin to gain access to the secure credential store values. In the Admin Console, go to Integrations > Third-Party Credentials > open your secure credential you have the RSA key stored in. Under 'plugins', search for 'JWT', add it, and click save. That should do the trick.

  • Thanks. I wanted to know where we would actually enter the RSA Keypairs in this function? My code is exactly like your example. However, I receive the following: 


    Expression evaluation error at function fn!createdocusignrsajwttoken: This plug-in [jwtTools] is not registered to access secured values for the given external system key [docusign]. Check the external systems plug-ins list in the Administration Console.

  • Please refer to this response, it was what I had to do to get this working!

  • Raymond, you are absolutely right, I hadn't even thought about that piece! I was unintentionally omitting the 'exp' field, and that was the problem. I saw that the value would default in the .java file for it and leapt to conclusions, and failed to include a null parameter for it. Goes to show even after years of this the little things can still come back to bite you.

    For anyone else who runs into a similar issue, here is an example usage of the function:

    fn!createdocusignrsajwttoken(
      externalSystemKey: "docusign",
      iss: "XXXXXX-XXXX-XXXXX-XXXXX",
      alg: "RS256",
      typ: "JWT",
      aud: "account-d.docusign.com",
      scope: "signature impersonation",
      exp: "",
      sub: "XXXXXX-XXXX-XXXXX-XXXXX"
    )

    Thanks again!