Expose a JWKS Endpoint from the Gateway

[ashera96]

Problem

We need to expose a JWKS endpoint from the Gateway in order to validate the backend JWTs. Also, the backend JWT token should include the kid claim.

Solution

Bring the current JWKS implementation to the gateway component. Use a configuration to decide weather or not the kid claim should be included in the backend JWT header.

Affected Component

APIM

Version

4.1.0

Implementation

No response

Related Issues

No response

Suggested Labels

No response

[herzcthu]

Waiting for this implementation to test further.

[ashera96]

We can use the following config under deployment.toml to add/remove the kid claim from the backend JWT. Unless this use_kid_property is explicitly set to false, the backend JWT header will include the kid claim.

[apim.jwt]
use_kid_property = true

You can invoke the JWKS endpoint using the following URLs:

• https://<host>:8243/jwks for super tenant
• https://<host>:8243/t/<tenant domain>/jwks for tenants