JSON Web Token (JWT) Parser

Problem this snippet solves:

This feature is now native in v13.1 and it is strongly recommended you implement the native solution instead. This code is left only as an example for future use cases, it should not be used for JWT handling because there is no signature validation.

This code parses a JWT (JSON Web Token) received by a Big-IP acting as an OAuth client and creates session variables for the JSON parameters in the header and payload. Example use cases might include Azure AD B2C or Azure AD Enterprise integration.

This iRule does not perform signature validation.

Code from the "Parse and Set Session Variables" section down could be easily harvested for other JSON parsing use cases that do not need the JWT decoding.

How to use this snippet:

Attach this iRule to the virtual server receiving the JWT that is configured for OAuth. Inside the VPE after the OAuth Client agent add an iRule agent with id jwt-parse.

This iRule will set several variables including: session.oauth.jwt.last.header session.oauth.jwt.last.payload session.oauth.jwt.last.signature

In addition it will create a session variable for each parameter in the header and payload in the following syntax. session.oauth.jwt.header.last.* session.oauth.jwt.payload.last.*

You can then call these session variables elsewhere.

Code :

when ACCESS_POLICY_AGENT_EVENT {
if { [ACCESS::policy agent_id] eq "jwt-parse" } {
#log local0. "JWT-Parse: Started"

#Get the JWT
set jwt [ACCESS::session data get -secure session.oauth.client.last.id_token]
#log local0. "JWT-Parse: JWT Received - jwt is $jwt"

#Separate the header, payload, and signature
set jwt_header [getfield $jwt "." 1]
ACCESS::session data set session.oauth.jwt.last.header $jwt_header
#log local0. "JWT-Parse: Header extracted - jwt_header and session.oauth.jwt.last.header are $jwt_header"
set jwt_payload [getfield $jwt "." 2]
ACCESS::session data set session.oauth.jwt.last.payload $jwt_payload
#log local0. "JWT-Parse: Payload extracted - jwt_payload and session.oauth.jwt.last.payload are $jwt_payload"
set jwt_signature [getfield $jwt "." 3]
ACCESS::session data set session.oauth.jwt.last.signature $jwt_signature
#log local0. "JWT-Parse: Signature extracted - jwt_signature and session.oauth.jwt.last.signature are $jwt_signature"

#Base 64 decode the header and payload

#Fix encoding issues in header
set jwt_header_modified $jwt_header
set tail [string length $jwt_header_modified]
if {$tail % 4 == 2} {
append jwt_header_modified {==}
} elseif {$tail % 4 == 3} {
append jwt_header_modified {=}
}
#log local0. "JWT-Parse: Header encoding fixes complete - jwt_header_modified is $jwt_header_modified"

#Fix encoding issues in payload
set jwt_payload_modified $jwt_payload
set tail [string length $jwt_payload_modified]
if {$tail % 4 == 2} {
append jwt_payload_modified {==}
} elseif {$tail % 4 == 3} {
append jwt_payload_modified {=}
}
#log local0. "JWT-Parse: Payload encoding fixes complete - jwt_payload_modified is $jwt_payload_modified"

#Base64 decode
set jwt_header_modified [b64decode $jwt_header_modified]
#log local0. "JWT-Parse: Header Base 64 decoded - jwt_header_modified is $jwt_header_modified"
set jwt_payload_modified [b64decode $jwt_payload_modified]
#log local0. "JWT-Parse: Payload Base 64 decoded - jwt_payload_modified is $jwt_payload_modified"

#Parse and Set Session Variables

#Remove JSON characters
set jwt_header_modified [string map {\{ {} \} {} \[ {} \] {} \" {}} $jwt_header_modified]
#log local0. "JWT-Parse: Header JSON Characters removed - jwt_header_modified is $jwt_header_modified"
set jwt_payload_modified [string map {\{ {} \} {} \[ {} \] {} \" {}} $jwt_payload_modified]
#log local0. "JWT-Parse: Payload JSON Characters removed - jwt_payload_modified is $jwt_payload_modified"

#Split into field/value pairs
set jwt_header_modified [split $jwt_header_modified ,]
#log local0. "JWT-Parse: Header Fields split - jwt_header_modified is $jwt_header_modified"
set jwt_payload_modified [split $jwt_payload_modified ,]
#log local0. "JWT-Parse: Payload Fields split - jwt_payload_modified is $jwt_payload_modified"

#Set APM session variables for each header parameter
foreach parameter $jwt_header_modified {
set variable_name [getfield $parameter ":" 1]
set variable_value [getfield $parameter ":" 2]
ACCESS::session data set session.oauth.jwt.header.last.$variable_name $variable_value
#log local0. "JWT-Parse: Header session variable set - session.oauth.jwt.header.last.$variable_name is $variable_value"
}

#Set APM session variables for each payload parameter
foreach parameter $jwt_payload_modified {
set variable_name [getfield $parameter ":" 1]
set variable_value [getfield $parameter ":" 2]
ACCESS::session data set session.oauth.jwt.payload.last.$variable_name $variable_value
#log local0. "JWT-Parse: Payload session variable set - session.oauth.jwt.payload.last.$variable_name is $variable_value"
}
}
}

Tested this on version: