JWKS Token Verification Support in IBM App Connect v12-v13

We would like to request the addition of JWKS (JSON Web Key Set) token verification support in IBM App Connect v12-v13. This feature is crucial for integrating with modern authentication and authorization mechanisms, particularly within OAuth2 and OpenID Connect-based environments.

IBM MQ has this feature: https://community.ibm.com/community/user/integration/blogs/vasily-shcherbinin1/2024/06/19/introducing-jwks

Feature Description

IBM App Connect v12 should be enhanced to support JWT (JSON Web Token) verification using JWKS (JSON Web Key Set). This would allow App Connect to dynamically retrieve public keys from an OpenID Connect-compliant authorization server and validate JWTs accordingly.

Currently, App Connect supports JWT authentication, but lacks automatic JWKS handling, which means public keys must be manually configured. By implementing JWKS support, App Connect could automatically retrieve, cache, and refresh public keys from a JWKS endpoint (e.g., https://auth.example.com/.well-known/jwks.json), significantly improving security and maintainability.

Required Capabilities

1. JWKS Endpoint Retrieval

   • App Connect should be able to fetch public keys from a configurable JWKS URL.

   • It should periodically refresh the keys to accommodate key rotation policies set by the identity provider (IdP).

2. JWT Signature Verification

   • Support for RSA (RS256, RS384, RS512) and ECDSA (ES256, ES384, ES512) algorithms, as per RFC 7518.

   • Verify the JWT’s signature using the corresponding public key from the JWKS set.

   • Support for kid (key ID) selection to identify the correct key within the JWKS response.

3. JWT Claims Validation

   • Support for validating the issuer (iss), audience (aud), and expiration (exp) claims.

   • Allow configurable validation rules via policy definitions or environment variables.

4. Key Caching & Rotation Handling

   • Implement a caching mechanism to store retrieved keys and minimize unnecessary network requests.

   • Support automatic key rotation detection to handle cases where old keys are deprecated.

5. Integration with OpenID Providers

   • Ensure compatibility with OpenID Connect-compliant identity providers, such as Keycloak, Okta, Auth0, Azure AD, Ping Identity, etc.

   • Reference OpenID Connect specifications:

     • OpenID Connect Core

     • OpenID Connect Discovery

6. Configuration Flexibility

   • The ability to configure JWKS verification via environment variables, properties files, or UI settings.

   • Options for manual key override in case of connectivity issues with the JWKS endpoint.

Business and Security Justification

• Improved Security: By supporting JWKS, App Connect will ensure that tokens are always validated against the latest public keys, reducing security risks from manual key management.

• Compliance with Industry Standards: Many security frameworks, including FAPI (Financial-grade API), Open Banking, and Zero Trust architectures, mandate the use of JWKS-based authentication.

• Reduced Operational Overhead: Automating key retrieval eliminates the need for frequent manual updates, streamlining system administration.

• Enhanced Compatibility: This feature ensures seamless integration with modern cloud-native and microservices architectures using OpenID Connect-based authentication.

References

• FAPI Readiness Criteria (FRC): Open Banking FAPI Readiness

• OpenID Connect Specification: OIDC Core 1.0

• RFC 7517 - JSON Web Key (JWK): RFC 7517

• RFC 7518 - JSON Web Algorithms (JWA): RFC 7518