Forum Discussion

Peter_Baumann's avatar
Peter_Baumann
Icon for Cirrostratus rankCirrostratus
Jun 22, 2021

oauth server generated jwt token problem

Hi all,

We have a customer try to do oauth with a dovecot server, they have the following problems using the f5 as a oauth server:

 

  1. The "typ" jwt header is missing, this should be set to "JWT".
  2. F5 set the JWT token nbf (not valid before) to some minutes in the past, this breaks dovecot auth.
  3. Customer want to use the following oauth features, are these supported?

https://openid.net/specs/openid-connect-frontchannel-1_0.html

https://openid.net/specs/openid-connect-backchannel-1_0.html

 

Do you know how the above could be customized in f5 to set to values the dovecot would accept?

 

Thank you for any hint.

Peter

application delivery
BIG-IP Access Policy Manager (APM)
iRules
jwt
oauth
openid
  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Jul 22, 2021

    use token_content_type with value jwt in post data while retrieving token via /f5-oauth2/v1/token

  • Peter_Baumann's avatar
    Peter_Baumann
    Icon for Cirrostratus rankCirrostratus
    Aug 10, 2021

    Unfortunately the customer changed the IdP now to Keycloak and this seems to fix all problems he had with the OAuth.

    The above is not the only one limitation F5 OAuth has, it would be great if F5 could be more customizable into this.

    I had a ticket open, also for the other customer problems, the only solution was a Feature Request without any timeline given when it would be implemented.

    • youssef1's avatar
      youssef1
      Icon for Cumulonimbus rankCumulonimbus
      Nov 04, 2021

      Hello Peter,

       

      I have exactly the same problem as you for another application.

      The "typ" jwt header is missing, this should be set to "JWT".

       

      have you had any feedback from the support? if not, could you give me the number of your incident? it will have weight if I open an incident about it.

       

      thank you for your help.

      regards,

       

       

      • Marvin's avatar
        Marvin
        Icon for Cirrocumulus rankCirrocumulus
        Nov 05, 2021

        You need to specify token_content_type with value jwt for JWT tokens to be provided by F5 oauth server via POST method to /f5-oauth2/v1/token, if you dont do that then you request Opaque token.

         

        Also first is always a GET request to /f5-oauth2/v1/authorize where I also append &token_content_type=jwt