How To Check For Valid Claim Inside JWT Token Using Oracle OSB And OWSM? (Doc ID 3071750.1)

Last updated on FEBRUARY 11, 2025

Applies to:

Goal

In a scenario where there are multiple applications calling with different tokens, the OWSM policy, oracle/http_jwt_token_service_policy, is used on the proxies. The load balancer is doing the SSL offloading. Currently, there is no way to verify if an application is authorized to call that OSB service. Thus when someone ( application ) knows the right endpoint(s) a service could be called with a valid JWT token even though the application should not be able to. There is no documentation on how to configure this and there is a need to add an extra authorization step when an OSB process is called.
The JWT spec states that the "groups" part inside the JWT token can be used to verify if a certain token is authorized. How can this be configure on the OSB process level?
 

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.