Understanding OAuth V2.0 (JWT Client Assertion Flow)

OAuth 2.0 (JWT Client Assertion Flow) is an authentication method that is used for connecting to REST endpoints in a secure way. This method enables you to generate access tokens for backends that use OAuth 2.0 by allowing clients to create digitally signed JWT assertions.

Adding custom fields

With the OAuth 2.0 (JWT Client Assertion Flow) authentication method, you can include custom fields in the account configuration window when setting up an account for a REST connector.

  1. When you select the OAuth 2.0 (JWT Client Assertion Flow) method from the Authentication Type drop-down list, the Add Field option appears on the screen. Click this option to configure the REST connector using this authentication method. The Add Field configuration window appears on the screen. You can define custom fields that appear in the Add Field configuration window while configuring an account for the REST connector.
  2. Follow the steps to fill values for the required fields:
    • Select Field Category: Choose a field category from the following options: Header, Claim, JWT Client Assertion
      • Header: The header is typically the first part of the token. It contains metadata that describes how the token is secured and how it must be processed.
        Note: Currently, webMethods Integration supports this authentication method for Microsoft endpoints only. So, to ensure the successful creation of a REST connector, it is essential to include an ‘x5t’ header value. x5t is a base64-encoded SHA-1 thumbprint that is associated with the X.509 certificate. When you enter ‘x5t’ as the header value in the Name field, a custom field appears in the account configuration window with a ‘+’ option. You can use this option to select an X.509 certificate from your local folder. After uploading the X.509 certificate, webMethods Integration automatically calculates the ‘x5t’ value, which is then displayed in the field.
      • Claim: Claim is an essential part in JWTs, providing context and additional information about the token. Currently, webMethods Integration supports this authentication method for Microsoft endpoints only. So, to ensure the successful creation of a REST connector, it is essential to include an ‘exp’ claim value. exp or expiration time is the time (in minutes) after which the JWT expires.
      • JWT Client Assertion: A JWT client assertion is a specific type of JWT used in OAuth 2.0 authentication. It serves as a means for a client (an application or service) to prove its identity when requesting access to protected resources from an authorization server. Currently, webMethods Integration supports this authentication method for Microsoft endpoints only. So, to ensure successful creation of a REST connector, it is essential to include ‘client_id’ and ‘scope’ assertion values. client_id is a unique identifier that is associated with the application while scope is the resource identifier (application ID URI) of the resource you want, affixed with the .default suffix. For example, https://graph.microsoft.com/.default.
    • Name: Specify the name for the selected field category. The value for this field is case-sensitive. For example, for Microsoft endpoints, it is mandatory to include ‘X5T,’ ‘expiration time,’ ‘client ID,’ and ‘scope.’ The names for these values should be ‘x5t,’ ‘exp,’ ‘client_id,’ and ‘scope,’ respectively.
    • Display name: Provide a suitable display name for this field. For example, client ID.
    • Description: Provide a short summary for this field.
    • Select data type: Select the data type you want to assign to the value of this field.
    • Default value: Specify the default value that you want to set for this field.
    • Allowed values: Define the values that you want to set for this field.
    • Field properties: Enable the specific property that you want to set for this field.
  3. Next, click Add. The Add option successfully creates and adds the custom field to the list of custom fields in the connector definition screen. The created custom field then appears on the account configuration window when you are setting up an account for a REST connector.
Note:
  • Currently, you can create custom fields with the same names as predefined fields on the account configuration window. However, this might cause duplicate entries with identical names to appear. For instance, creating a custom field with the same name as an existing predefined field, such as ‘Issuer,’ leads to multiple entries with identical names on the account configuration window.
  • If you enter x5t as the header value in the Name field, a custom field appears in the account configuration window with a ‘+’ option. You can use this option to select an X.509 certificate from your local folder. After uploading the X.509 certificate, webMethods Integration automatically calculates the x5t value, and it is displayed in the field. However, when configuring this custom field, even if you enter default and allowed values, they do not appear on the account configuration window.
  • When configuring a custom field, if you specify a default value that is not included in the list of allowed values, no warning or error messages are displayed to indicate this inconsistency.
  • You can add multiple custom fields using the OAuth V2 JWT Client Assertion Flow authentication method for a REST connector.
  • Once you create a custom field, it cannot be edited or deleted.