JWT - how PS uses it
- How-to
- mike S
- PowerServer
- Sunday, 5 November 2023 04:45 PM UTC
I'm looking at building my own JWT auth service so that i can not only validate with my database, but also send back information in addition to the token (the URL of the PS web api , the database to use, etc.)
the PS web api needs to validate the token on each request, and i believe the simplest/fastest way to handle that is to provide it the same JWT secret as my JWT token generation service. however, i may end up using another service to validate the token since i may end up having several PS web api servers.
has anyone done either of these? would it make sense to use the native PS jwttoken validation? the values that PS requires is not mentioned or defined anywhere. the token generation includes a few things like issuer and Audience, are they actually used by PS? I also don't see in the PS c# code where the SecurityAlgorithms are setup - HmacSha256Signature ? or 512?
the PB GetJWTToken method retrieves the token from the HTTP client. To use this, what does the GetJWTToken require in terms of the returned format?
Just {"token":"<token>"} in the body? is that based on a standard? or is GetJWTToken built for the PS specific implementation only?
Find Questions by Tag
Helpful?
If a reply or comment is helpful for you, please don’t hesitate to click the Helpful button. This action is further confirmation of their invaluable contribution to the Appeon Community.