Skip to main content
Feedback

Overview of OAuth2JWT Authentication Policy

Description

  • This policy authenticates API requests from the client using a Cloud API Management OAuth2 access token as well as a third-party JWT at the same service endpoint.

  • The policy supports an embedded API Key (client_id) passed in the JWT payload claim via the API request to perform authentication.

  • Policy enforces the existence and validity of a JWT specified in the HTTP Authorization header.

  • The policy supports injecting claim values into the request to enrich HTTP headers, as specified in the PreInput Value configuration.

  • The policy provides a configurable capability to block/forward the HTTP Authorization header to the backend/origin server.

  • Natively supports chaining of API Management customer processors and Policies.

  • Supports JSONPath expression to locate claim value for non-standard JWT claims, , including claims used for client ID detection (Key Field Identifier) and for header injection (inject_headers).

  • Supports JSONPath expression to locate claim value for non-standard JWT claims.

  • Support the match policy to allow additional validation based on the JWT claim value.

  • Supports pre-processing of API requests.

On this Page