Skip to content

Fix: Add x5c parameter description to JWKS documentation for all affected versions (Product IS issue #19610) #5631

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix: Add x5c parameter description to JWKS documentation for all affected versions (Product IS issue #19610) #5631

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# JSON Web Key Set

Check failure on line 1 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Trailing spaces 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:1:19 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md009.md

## What is JSON Web Key Set (JWKS)?

Check failure on line 3 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Disallow consecutive headings 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:3 no-consecutive-headings Disallow consecutive headings [Consecutive headings are not allowed.] [Context: "## What is JSON Web Key Set (JWKS)?"]

The JSON Web Key Set (JWKS) endpoint is a read-only endpoint that returns
the authorization server's public key set in the JWKS format.

Check failure on line 6 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Trailing spaces 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:6:62 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md009.md
This contains the signing key(s) that the Relying Party (RP) uses to validate signatures from the server.
For more information on this endpoint, see the [OpenID Connect Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html).

Expand All @@ -12,7 +12,7 @@
## Usage of JWKS

The main benefit of allowing JWKS endpoint configuration is its ability to handle key rotation by external identity providers.
Configuring this endpoint would enable you to programmatically discover JSON web keys and allow the third party

Check failure on line 15 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Trailing spaces 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:15:112 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md009.md
identity providers to publish new keys without having the overhead of notifying each and every client application.
This allows smooth key rollover and integration.

Expand All @@ -23,27 +23,27 @@
The following sequence diagram illustrates the scenario where a JWT obtained
from a third party IdP is validated using the JWKS-based JWT Validator.

![JWKS validation flow]({{base_path}}/assets/img/concepts/jwks-validation-flow.png)

Check failure on line 26 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Trailing spaces 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:26:84 MD009/no-trailing-spaces Trailing spaces [Expected: 0 or 2; Actual: 1] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md009.md

The steps of the above diagram are explained below:

**Step 1:**

- User requests a JWT assertion from the identity provider.

Check failure on line 32 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Spaces after list markers 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:32:1 MD030/list-marker-space Spaces after list markers [Expected: 1; Actual: 3] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md030.md

- A valid JWT is returned with the response.

Check failure on line 34 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Spaces after list markers 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:34:1 MD030/list-marker-space Spaces after list markers [Expected: 1; Actual: 3] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md030.md

**Step 2:**

- The user initiates a token request to WSO2 Identity Server’s token endpoint

Check failure on line 38 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Spaces after list markers 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:38:1 MD030/list-marker-space Spaces after list markers [Expected: 1; Actual: 3] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md030.md
using JWT grant type with the obtained JWT assertion.

- Access token issuer handles all the requests sent to the token

Check failure on line 41 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Spaces after list markers 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:41:1 MD030/list-marker-space Spaces after list markers [Expected: 1; Actual: 3] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md030.md
endpoint.

**Step 3:**

- Access token issuer invokes the JWT grant handler to validate the

Check failure on line 46 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / lint

Spaces after list markers 

en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md:46:1 MD030/list-marker-space Spaces after list markers [Expected: 1; Actual: 3] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md030.md
provided JWT assertion.

- Deploys and configures the JWT client-handler artifacts.
Expand Down Expand Up @@ -101,11 +101,12 @@
}
```

| Property Value | Description |
| --------------------- | ------------- |
| kty | The public key type.|
| e | The exponent value of the public key.|
| use | Implies how the key is being used. The value sig represents signature.|
| kid | The thumbprint of the certificate. This value is used to identify the key that needs to be used to verify the signature. |
| alg | The algorithm used to secure the JSON Web Signature. |
| n | The modulus value of the public key. |
| Property Value | Description |
| --------------------- | ------------- |
| kty | The public key type.|

Check warning on line 106 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[WSO2-IAM.Spelling] Did you really mean 'kty'?

Raw Output:
{"message": "[WSO2-IAM.Spelling] Did you really mean 'kty'?", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 106, "column": 3}}}, "severity": "WARNING"}
| e | The exponent value of the public key.|
| use | Implies how the key is being used. The value sig represents signature.|

Check warning on line 108 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[write-good.E-Prime] Try to avoid using 'being'.

Raw Output:
{"message": "[write-good.E-Prime] Try to avoid using 'being'.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 108, "column": 40}}}, "severity": "INFO"}

Check warning on line 108 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[write-good.Passive] 'being used' may be passive voice. Use active voice if you can.

Raw Output:
{"message": "[write-good.Passive] 'being used' may be passive voice. Use active voice if you can.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 108, "column": 40}}}, "severity": "WARNING"}

Check warning on line 108 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[Microsoft.Passive] 'being used' looks like passive voice.

Raw Output:
{"message": "[Microsoft.Passive] 'being used' looks like passive voice.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 108, "column": 40}}}, "severity": "INFO"}

Check warning on line 108 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[write-good.E-Prime] Try to avoid using 'is'.

Raw Output:
{"message": "[write-good.E-Prime] Try to avoid using 'is'.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 108, "column": 37}}}, "severity": "INFO"}
| kid | The thumbprint of the certificate. This value is used to identify the key that needs to be used to verify the signature. |

Check warning on line 109 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[write-good.E-Prime] Try to avoid using 'be'.

Raw Output:
{"message": "[write-good.E-Prime] Try to avoid using 'be'.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 109, "column": 105}}}, "severity": "INFO"}

Check warning on line 109 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[Microsoft.Passive] 'be used' looks like passive voice.

Raw Output:
{"message": "[Microsoft.Passive] 'be used' looks like passive voice.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 109, "column": 105}}}, "severity": "INFO"}

Check warning on line 109 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[write-good.Passive] 'is used' may be passive voice. Use active voice if you can.

Raw Output:
{"message": "[write-good.Passive] 'is used' may be passive voice. Use active voice if you can.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 109, "column": 63}}}, "severity": "WARNING"}

Check warning on line 109 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[write-good.E-Prime] Try to avoid using 'is'.

Raw Output:
{"message": "[write-good.E-Prime] Try to avoid using 'is'.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 109, "column": 63}}}, "severity": "INFO"}

Check warning on line 109 in en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md

View workflow job for this annotation

GitHub Actions / Vale style check 

[vale] reported by reviewdog 🐶
[Microsoft.Passive] 'is used' looks like passive voice.

Raw Output:
{"message": "[Microsoft.Passive] 'is used' looks like passive voice.", "location": {"path": "en/identity-server/6.0.0/docs/references/concepts/authentication/jwks.md", "range": {"start": {"line": 109, "column": 63}}}, "severity": "INFO"}
| alg | The algorithm used to secure the JSON Web Signature. |
| n | The modulus value of the public key. |
| x5c | The X.509 certificate chain. Contains a chain of one or more PKIX certificates in base64-encoded DER format. For more information, see the [RFC 7517 specification](https://datatracker.ietf.org/doc/html/rfc7517#section-4.7). |
17 changes: 9 additions & 8 deletions en/identity-server/6.1.0/docs/references/concepts/authentication/jwks.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,11 +101,12 @@ The default JWKS of WSO2 Identity Server is as follows.
}
```

| Property Value | Description |
| --------------------- | ------------- |
| kty | The public key type.|
| e | The exponent value of the public key.|
| use | Implies how the key is being used. The value sig represents signature.|
| kid | The thumbprint of the certificate. This value is used to identify the key that needs to be used to verify the signature. |
| alg | The algorithm used to secure the JSON Web Signature. |
| n | The modulus value of the public key. |
| Property Value | Description |
| --------------------- | ------------- |
| kty | The public key type.|
| e | The exponent value of the public key.|
| use | Implies how the key is being used. The value sig represents signature.|
| kid | The thumbprint of the certificate. This value is used to identify the key that needs to be used to verify the signature. |
| alg | The algorithm used to secure the JSON Web Signature. |
| n | The modulus value of the public key. |
| x5c | The X.509 certificate chain. Contains a chain of one or more PKIX certificates in base64-encoded DER format. For more information, see the [RFC 7517 specification](https://datatracker.ietf.org/doc/html/rfc7517#section-4.7). |
Loading