Client-Side Token Validation
From IdS release 12.6(2), IdS issues access tokens that are signed and validated using assymetric key pair. So, the public key of the key pair can be used to validate the access tokens. If the clients have the IdS public key, they can validate the access tokens by themselves without the help of IdS. The following APIs are available to access the public key:
-
https://<IdSFQDN>/ids/v1/keys/token/public—Gets the public key that is used to validate the token.
-
https:/<IdSFQDN>/ids/v1/keys/token/public/csr—Gets the Certificate Signing Request (CSR) that is used to get a signed certificate from a CA.
-
https://<IdSFQDN>/ids/v1/keys/token/public/x509—Gets x509 token certificate.
Prerequisite
-
Clients should have the same Coordinated Universal Time (UTC) time as that of the IdS server.
Use this API at the client side to obtain the public key from the IdS server to validate the access tokens issued by IdS. For more information about token validation using public key, refer to https://jwt.io.
|
URIs: |
https://<IdSFQDN>/ids/v1/keys/token/public https://<IdSFQDN>/ids/v1/keys/token/public/csr https://<IdSFQDN>/ids/v1/keys/token/public/x509 |
|
Example URI: |
https://ids.autobot.cvp:8553/ids/v1/keys/token/public |
|
Security Constraints: |
Admin or client credentials protected. |
|
HTTP Method: |
GET |
|
Content Type: |
text/plain |
|
Request Parameter: |
download=true (Optional) |
|
HTTP Response: |
200: Success 401: Unauthorized (for example, the user is not authenticated in the Web Session) 500: Internal Server Error |
|
Example Response to get public key: |
|
|
Example Response to get Certificate Signing Request (CSR): |
|
|
Example Response to get x509 token certificate: |
|