On a token request, a client crafts a JWT assertion that contains a message authentication code (MAC) in its signature part, and includes it to the request. Then an authorization server authenticates the client by verifying the signature and payload of the assertion.
Authlete supports client_secret_jwt as a client authentication method so that authorization servers can enable it. This article describes overview of the method and setup instructions with Authlete. client-secret-jwt.png73.8 KB
Requirements for client_secret_jwt
The following section describes details on both client and authorization server side.
Client
A client must include the following parameters in a token request when using the client_secret_jwt method.
Parameter
Description
client_assertion_type
A type of client_assertion. Its value must be "urn:ietf:params:oauth:client-assertion-type:jwt-bearer".
client_assertion
A JWT that contains information for client authentication. It must contain a MAC using a shared key. See below for details.
The value of client_assertion must satisfy the following requirements on its JWT payload and JWT signature. You can find an example JWT in the "Generating a JWT assertion" section.
Payload
A JWT assertion must contain the REQUIRED claims listed below.
Claim
Description
iss
[REQUIRED] Issuer. This must contain the client_id of the OAuth client.
sub
[REQUIRED] Subject. This must contain the client_id of the OAuth client.
aud
[REQUIRED] Audience. A value that identifies the authorization server as an intended audience. The authorization server must verify that it is an intended audience for the token. The audience should be the URL of the authorization server's token endpoint.
jti
[REQUIRED] JWT ID. A unique identifier for the token, which can be used to prevent reuse of the token. These tokens must only be used once unless conditions for reuse were negotiated between the parties; any such negotiation is beyond the scope of this specification.
exp
[REQUIRED] Expiration time on or after which the JWT must not be accepted for processing.
iat
[OPTIONAL] Time at which the JWT was issued.
Signature
The signature of the JWT must be calculated using HMAC-SHA algorithm e.g. HS256.
Client secret must be used as a shared key on calculating the signature.
Authorization server
An authorization server must process a token request as per the specifications listed below. The details are omitted here because you can offload these operations from your authorization server to Authlete.
This section explains settings for enabling the client_secret_jwt method. You have to configure both Authlete service and its client to be authenticated with the method.
Authlete service
Configure the following setting in Service Owner Console.
Generate a JWT assertion including the payload, and a MAC using the client's shared key (client secret). The example below is an instruction using an authlete-jose library. Or you can use mkjose.org website to do that.
Authlete supports client_secret_jwt as a client authentication method so authorization servers can enable it. This article describes overview of the method and setup instructions with Authlete.
This article explains “OAuth 2.0 client authentication”. In addition to the client authentication methods described in RFC 6749, this article explains methods that utilize a client assertion and a client certificate.