For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

awan_m's avatar
awan_m
Icon for Cirrostratus rankCirrostratus
Mar 22, 2023

F5 oAuth Federation with client assertion type = jwt-bearer

Hi -  i am trying to setup user authentication with oAuth and F5 is the Client + Resour provider - that needs to authenticate the user -  Question - the options available are to send clientid and s...
application delivery
Matt_Dierick's avatar
Matt_Dierick
Icon for Employee rankEmployee
Mar 28, 2023

Hi,

If I understand correctly, APM is set as Client and RS. It means APM will redirect the user to your AS in order to authenticate and get a token (Client role). Which grant is set in your AS ? Authorization code grant ?

Then APM will validate the JWT token (RS role).

By default, APM uses JWT-BEARER as insertion type, and JWT signed (not encrypted by default)

  • awan_m's avatar
    awan_m
    Icon for Cirrostratus rankCirrostratus
    Mar 28, 2023

    Thanks for the response 

    for openidconnect - i have setup flow type as Hybrid - and Hybrid response type as code-idtoken-token

    my identity provider is forgerock asn the attached image shows teh flow