Forum Discussion
Peter_Baumann
Cirrostratus
Cirrostratusoauth server generated jwt token problem
Hi all,
We have a customer try to do oauth with a dovecot server, they have the following problems using the f5 as a oauth server:
- The "typ" jwt header is missing, this should be set to "JWT".
- F5 set the JWT token nbf (not valid before) to some minutes in the past, this breaks dovecot auth.
- Customer want to use the following oauth features, are these supported?
https://openid.net/specs/openid-connect-frontchannel-1_0.html
https://openid.net/specs/openid-connect-backchannel-1_0.html
Do you know how the above could be customized in f5 to set to values the dovecot would accept?
Thank you for any hint.
Peter
Peter_BaumannUnfortunately the customer changed the IdP now to Keycloak and this seems to fix all problems he had with the OAuth.
The above is not the only one limitation F5 OAuth has, it would be great if F5 could be more customizable into this.
I had a ticket open, also for the other customer problems, the only solution was a Feature Request without any timeline given when it would be implemented.
youssef1Cumulonimbus
Hello Peter,
I have exactly the same problem as you for another application.
The "typ" jwt header is missing, this should be set to "JWT".
have you had any feedback from the support? if not, could you give me the number of your incident? it will have weight if I open an incident about it.
thank you for your help.
regards,
MarvinCirrocumulus
You need to specify token_content_type with value jwt for JWT tokens to be provided by F5 oauth server via POST method to /f5-oauth2/v1/token, if you dont do that then you request Opaque token.
Also first is always a GET request to /f5-oauth2/v1/authorize where I also append &token_content_type=jwt
- Marvin
use token_content_type with value jwt in post data while retrieving token via /f5-oauth2/v1/token