Opaque access tokens are an interesting idea for
security reasons. I’ve heard them referred to as "by reference"
access tokens because the actual JWT access token has to be
stored somewhere. The OpenID spec doesn’t address this but it’s
a solid idea for access tokens exposed to external applications,
which do not need to be concerned with, or possibly shouldn’t be
privy to the information inside the token.
There’s another option that may be more manageable.
That is to offer a per client option of encrypting the access
token, known as JWE, or JSON Web Encryption[0]. The basic idea
is that the signed token is then encrypted with a symmetrical
key. This key would probably be a realm level key. Another
benefit or JWE is the access token payload is compressed, making
the access token shorter.
Is this something we would be interested in adding
support for?
Scott Rossillo
Smartling | Senior Software Engineer
Yes, that's true (even for some
open source software too).
So am I supposed to put this JWT access token into the
Authorization request header as Bearer value to
authorize a request?
The access token I got from Keycloak is over 5000
characters long!
On 05.02.2016 13:47, Raghuram
Prabhala wrote:
Access token is implementation specific.
Some commercial software have the concept of
"reference tokens" which are nothing but random
strings indicated below. The clients have to query
back the Authorization server to get a validated
JWT token
There's no such thing as a
"simple token". Tokens are always a
signed JWT.
--
========================================
Caprica Ltd.
69 Great Hampton Street
Birmingham, West Midlands, B186EW,
Registered in England and Wales
Company No. 5298548
Managing Director: Manfred Duchrow
Zweigniederlassung Deutschland
Gartenstr. 48, 89150 Laichingen
Amtsgericht Ulm: HRB 5073
Geschäftsführer: Manfred Duchrow
----------------------------------------
Tel: +49 (0)7333 9232190
Fax: +49 (0)7333 9232191
E-Mail: manfred.duchrow@caprica.de
========================================
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user