cancel
Showing results for 
Search instead for 
Did you mean: 

oauth server generated jwt token problem

Peter_Baumann
Cirrostratus
Cirrostratus

Hi all,

We have a customer try to do oauth with a dovecot server, they have the following problems using the f5 as a oauth server:

 

  1. The "typ" jwt header is missing, this should be set to "JWT".
  2. F5 set the JWT token nbf (not valid before) to some minutes in the past, this breaks dovecot auth.
  3. Customer want to use the following oauth features, are these supported?

https://openid.net/specs/openid-connect-frontchannel-1_0.html

https://openid.net/specs/openid-connect-backchannel-1_0.html

 

Do you know how the above could be customized in f5 to set to values the dovecot would accept?

 

Thank you for any hint.

Peter

4 REPLIES 4

Marvin
Cirrostratus
Cirrostratus

use token_content_type with value jwt in post data while retrieving token via /f5-oauth2/v1/token

Peter_Baumann
Cirrostratus
Cirrostratus

Unfortunately the customer changed the IdP now to Keycloak and this seems to fix all problems he had with the OAuth.

The above is not the only one limitation F5 OAuth has, it would be great if F5 could be more customizable into this.

I had a ticket open, also for the other customer problems, the only solution was a Feature Request without any timeline given when it would be implemented.

Hello Peter,

 

I have exactly the same problem as you for another application.

The "typ" jwt header is missing, this should be set to "JWT".

 

have you had any feedback from the support? if not, could you give me the number of your incident? it will have weight if I open an incident about it.

 

thank you for your help.

regards,

 

 

You need to specify token_content_type with value jwt for JWT tokens to be provided by F5 oauth server via POST method to /f5-oauth2/v1/token, if you dont do that then you request Opaque token.

 

Also first is always a GET request to /f5-oauth2/v1/authorize where I also append &token_content_type=jwt