In this article

Overview

Use the Java Web Token (JWT) Validator policy to authenticate a request with a token. When you apply this policy, API consumers must use their JWT credentials to sign their JWT. Before allowing API access to the consumer, the policy does the following:

The policy checks if the JWT token is valid
If valid, the policy processes the request
If invalid, the policy discards the request

The JWT token works with the Authorize by Role policy. The value for the JWT role is the value for the Role field in the Authorize by Role Policy.

Policy Execution Order

This JWT Validator policy executes after the request has been authorized.

Expression Enabled Fields in API Policies

All expression enabled fields take expressions from the SnapLogic Expression Language and the API Policy Manager functions.

Settings

Parameter Name	Description	Default Value	Example
Label	Required. The name for the API policy.	JWT Validator	Task JWT Validator
When this policy should be applied	An expression enabled field that determines the condition to be fulfilled for the API policy to execute. For example, if the value in this field is request.method == "POST", the API policy is executed only if the request method is a POST.	True	request.method == "POST"
Signing Algorithm	RSA HSA ECDSA	RSA	ECDSA
Key·	None	N/A	·················
Extract into $token	Required. Specifies the location to find the key in the request. If one of the given locations is not found, this API policy will pass the request through to the next API policy.	N/A	N/A
Custom Header Keys	The names of the headers. If more than one header is given, they will all be checked. Click + to add more custom header keys.	N/A	N/A
Key	The name of the custom header key.		$.aud
Custom Query String Parameter Keys	The names of the query parameters. If more than one name is given, they will all be checked. Click + to add more custom query string parameters.	N/A	N/A
Key	The name of the custom query string parameter.		$key
Custom Cookie Key	The names of the cookies. You can add more than one cookie. Click + to add more custom cookies. The value input in the Cookie is to be replaced with the access token while using Postman or any other tool.	N/A	N/A
Key	The name of the Custom Cookie Key		Cookie_1
Authorization Header Type	If the key is in the Authorization header, this value is used as the “type” to check.	N/A
Extract User Info*	Required. Specifies how to extract information about the user from the working object.	N/A	N/A
User ID Expression	An expression that returns a string to be used as the user ID.	N/A	$qty
Roles Expression	An expression that returns the list of roles for the user.	N/A	$aud
Status	Indicates whether the API policy is enabled or disabled.	Enabled	Disabled

Example of Configuring the JWT Validator API Policy using RSA and HSA Signing Algorithms.

Pre-requisites

Apply Authorization by Role Policy.
Signature Algorithms, Key, User ID, Role and Cookie Key .

RSA Signing Algorithm Field Mappings:

To generate RSA token through Auth0 API.

Setup the JWT API in the Auth0 Dashboard > Applications > API, with RSA Signing Algorithm and identifier as the role that is needed for the policy:

Extract the access token property from the response by issuing the API call using any API Platform like Postman:

Decode the access token using the jwt.io for extracting the key.
Role is configured in the Authorize by Role policy. Update User ID and Role with the $sub and $aud expression values in the respective fields in policy dialogue box to fetch the information:

The value for the JWT role expression field is fetched from the value for the Role field in the Authorize by Role Policy.

To add Custom Cookie Key, you need to add domain to your API or Proxy endpoint using Postman. Now add cookie and replace the value with the access token and save it.

Use the obtained Key, User ID, Role and Cookie Key for the JWT Validator Policy:

Parameter Name		Field Type	Example
Label*		String	JWT Validator Policy
When this policy should be applied		String/Expression	request.method == "POST"
Signing Algorithm*		Dropdown	RSA
Key*		String	{ "e": "AQAB", "kty": "RSA", "n": "tPzmusbjBZThiVXqQkcCFYy3_JI__NaB58n6LmRkFZAsKURjfvO2KsyR_XZ6X9_7LGk8LApzTQ7ReJJhnDuCZ6p6OEs5BzqFLsW--JbbavZALzmw-Rnkl9Z9JiXL-E1xq6gpFpPsdHD8loRNa8YhHWNFQmGWRoWZzkNLc7yxKBCfJMe6ZtiXX00NPpCaxtaIKwFQGyfsYWDAqUcJmHNyA1rb_ByKlEV1_YgtjQPKdgY0-gOOhmONsz9MCAVrYk4s2yJWqVvSbZl31Na0FWlPu0zD4a9fm5XtyYuC0vS7ZIX694rXaheKWTRq9xssMPgAvnBZ0MVVUVd-8c6UrkH8Ww" }
Extract into $token*
	Customer Header Keys	String/Expression	x-api-key
	Custom Query String Parameter Keys	String/Expression	myquery
	Custom Cookie Key	String/Expression	Cookie_4
	Authorization Header Type	String	bearer
Extract User Info*			N/A
	User ID Expression*	String/Expression	$sub
	Roles Expression*	String/Expression	$aud
Status		Dropdown List	Enabled

Follow the same process for HSA Signing Algorithm.