APM: OAUTH2 JWT Token with groups claim

Okay, I now opened a support ticket and let you know about the result.

I believe this is possible (at least on <= 14.1) if you use an iRule event. Something like:

...
set mygroups [ ACCESS::session data get "session.mygroups" ]
append payload {,"mygroups":} "\[$mygroups\]"
...

This is adapted from the example at: https://devcentral.f5.com/wiki/iRules.ACCESS__oauth.ashx

In my AP I have a variable assign with an expression of:

return {"group1","group2"}

Hi,

yes, this is the easy part; but as we are not using the irule commands but the APM features directly to generate a JWT, i probably cant modify the resulting JWT inside an irule event?

Cheers, Rene

In my case I had to remove the SSO Bearer Token config from the Access Policy and replace it with an iRule.

But that wont work when F5 is acting as Authorization server, since it will generate the JWT along with the refresh token through some black-box-magic. If there is any way to modify this generated JWT with an iRule, now this would make me quite happy, but i couldnt find any way to do this.

Also, just for reference, take care when using ACCESS:oauth sign, since it will generate the Token with Base64Uriencoding (without padding), which is different from the actual APM VE config, which will do base64encoding WITH padding for some obscure reason.

Ah I see. Different use-case, same problem. I was seeing the same issue, but using APM for generating a Bearer token and not as the Authorization server, but the same issue occurs in both.