JSON WebToken Calculator | X4Documentation

This adapter generates, verifies, and processes JSON WebTokens.

Name of the adapter up to version 5.5.4: JSON WebToken

Properties

Operation

Operation executed by the adapter

Possible values:

CreateJWT: Generates a JSON WebToken (JWT) from an XML document
Verify: Verifies the JWT generated by the X4 Server
CreateXML: Creates the associated XML document from a JWT generated by the X4 Server

Parameters

The following parameters are required for the above operations:

	CreateJWT	Verify	CreateXML
algorithm	required	required	required
useServerSecret		required if `useSecretAsPublicKey` is not used .
useSecretAsPublicKey		required if `searchString` is not used .
secret		required if `useSecretAsPublicKey` is used.
keystoreUrl	required		required
keystoreType	required		required
keystorePassword	required		required
keyAlias	required		required
keyPassword	required		required

`algorithm`	Algorithm used for the operation Possible values: `HMAC256` `HMAC384` `HMAC512` `RSA256` `RSA384` `RSA512` `ECDSA256` `ECDSA384` `ECDSA512`
`useServerSecret`	Only relevant for HMAC algorithms. Specifies whether to use an embedded server secret or a custom server secret. Possible values: `true`: Use the embedded server secret `false`: Use custom server secret If a custom server secret is used, it must be specified with the `secret` parameter.
`useSecretAsPublicKey`	Only relevant for RSA and ECDSA algorithms. Specifies whether the value of the `secret` parameter is used as the public key. Possible values: `true`: Use the value of the `secret` parameter as the public key If the value of the `secret` parameter is used as the public key, the `secret` parameter is required. `false`: Do not use the value of the `secret` parameter as a public key
`secret`	Only relevant for HMAC algorithms. Password used to encrypt or decrypt a token. Possible values: Base64 encrypted password
`keystoreUrl`	URL to the keystore containing the RSA/ECDSA key pair Possible values: URL to a keystore The keystore must be supported by the Java Security API, such as JKS or PKCS#12.
`keystoreType`	Type of keystore containing the RSA/ECDSA key pair Possible values: Type of keystore, such as `jks` or `pkcs12`
`keystorePassword`	Password of the keystore containing the RSA/ECDSA key pair Possible values: Password
`keyAlias`	Alias of the asymmetric key used for RSA/ECDSA algorithms Possible values: Alias of the key used
`keyPassword`	Password of the asymmetric key used for RSA/ECDSA algorithms Possible values: Password of the key used

Status values

1

The adapter operation was successful.

CreateJWT operation: There is a JSON WebToken in the output.
Verify operation: The JSON WebToken is valid.
CreateXML operation: The output contains the XML document for the JSON WebToken.

-1

An error occurred while running the adapter:

CreateJWT and CreateXML operations: There is an error message in the output.
Verify operation: The JSON WebToken is invalid.

400

The token has expired.

This status value is returned only by the CreateXML and Verify operations.

Input

Depending on the operation, the adapter expects different inputs:

- CreateJWT operation: An XML document is expected which has the following format:

The header types type (parameter: keystoretype) and alg (parameter: algorithm) are set by the adapter.
Do not use claims with duplicated names.

The Header element is optional and can be declared as required. For example, Microsoft Azure expects a header declaration.

Sample input

XML

<?xml version="1.0" encoding="UTF-8">
<TokenContent>
	<Headers>
		<Header name="x5t">hOBcHZi846VCHSJbFAs26Go9VTQ=</Header>
		<Header name="kid">vdgdINF455FBKWDSEF5gdrgddgg=</Header>
	</Headers>
    <Subject name="sub" type="String">1234567890</Subject>
	<ExpiresAt name="exp" type="Integer">1577750400</ExpiresAt>
	<NotBefore name="nbf" type="Integer">946684800</NotBefore>
	<Id name="jti" type="String">007</Id>
	<Claims>
		<Claim name="name" type="String">John Doe</Claim>
		<Claim name="admin" type="boolean">true</Claim>
	</Claims>
</TokenContent>

For additional information about the claims that are being used and their XML objects, see iana.org. For unreserved claims, the names can be assigned as desired, but they cannot be the same as previously reserved claims such as bsp. or exp.

The values String , Boolean , Integer, Long , and Double are available as types.

The ExpiresAt, NotBefore, and IssuedAt elements are expected to be in Unix time format.

Verify and CreateXML operations: A JSON WebToken is expected that can come from an intermediate step or be passed as a text file (.txt).

Output

Depending on the operation, the adapter returns different results:

CreateJWT operation: There is a JSON WebToken in the output.
Verify operation: If the JWT is valid, it will be returned.
CreateXML operation: The output contains the XML document for the JSON WebToken.