diff --git a/modules/reference/pages/feature/jwt/examples.adoc b/modules/reference/pages/feature/jwt/examples.adoc index e9e78dacad..c40ef5a0da 100644 --- a/modules/reference/pages/feature/jwt/examples.adoc +++ b/modules/reference/pages/feature/jwt/examples.adoc @@ -11,19 +11,14 @@ The following example shows how to configure the server for constructing a JSON ---- -The `ID` attribute for the `jwtBuilder` element named `myBuilder` identifies the JWT builder, and uses the default `keyAlias` attribute to locate the private key. +The `id` attribute for the `jwtBuilder` element named `myBuilder` identifies the JWT builder, and uses the default `keyAlias` attribute to locate the private key. The `issuer` attribute in the example is the `\http://example.com` URL that identifies who issued the JSON Web Token. The `expiry` attribute indicates the token expiration time, which is 600 seconds. === Configure the JWT consumer -When you add the `jwt-1.0` feature and save your changes, Open Liberty adds the following default `jwtConsumer` element. -[source, xml] ----- - - ----- +When you add the `jwt-1.0` feature and save your changes, Open Liberty adds the `jwtConsumer` element. For information about `jwtConsumer` attributes that you can configure, see config:jwtConsumer[display=JWT consumer]. @@ -31,11 +26,13 @@ In this default configuration, the following values are assumed. - The `alg` header of the consumed JWT is RS256. You can configure this value on the `signatureAlgorithm` attribute. - A JWT is considered to be valid within 5 minutes of the `exp`, `nbf`, and `iat` claims. You can configure this value on the `clockSkew` attribute. -You can reconfigure this default `jwtConsumer` element, or create one or more other `jwtConsumer` elements. Each `jwtConsumer` element must have a unique, URL-safe string specified as the `id` attribute. If the ID is missing, the `jwtConsumer` is not processed. + +You can reconfigure these defaults by specifying a `jwtConsumer` element with an `id` value of `defaultJWTConsumer` and configuring attribute values. You can also create one or more other `jwtConsumer` elements. Each `jwtConsumer` element must have a unique, URL-safe string specified as the `id` attribute value. If the `id` value is missing, the `jwtConsumer` is not processed. For more information about the available configuration attributes, see config:jwtConsumer[display=JWT consumer]. For JWT tokens that are signed with RS256 and an X.509 certificate, you must configure the `trustStoreRef` and `trustAliasName` attributes so that you can locate the signature verification key. --Import the JWT issuer's X.509 certificate into the truststore. --In the `jwtConsumer` element, specify the truststore ID and the certificate alias. + +. Import the JWT issuer's X.509 certificate into the truststore. +. In the `jwtConsumer` element, specify the truststore ID and the certificate alias. [source, xml] ---- @@ -44,9 +41,9 @@ For JWT tokens that are signed with RS256 and an X.509 certificate, you must con ---- === Verify and parse JWT tokens in your application -The following example shows how to programmatically verify and parse JWT tokens by implementing the `com.ibm.websphere.security.jwt.JwtConsumer` and `com.ibm.websphere.security.jwt.JwtToken` APIs in your application. +The following examples show how to programmatically verify and parse JWT tokens by implementing the `com.ibm.websphere.security.jwt.JwtConsumer` and `com.ibm.websphere.security.jwt.JwtToken` APIs in your application. -- Create a `JwtConsumer` object. If you do not specify a configuration ID, the object is tied to the default `jwtConsumer` configuration. +. Create a `JwtConsumer` object. If you do not specify a configuration ID, the object is tied to the default `jwtConsumer` configuration. [source, java] ---- @@ -60,7 +57,7 @@ If you specify a configuration ID, the object is tied to the `jwtConsumer` confi com.ibm.websphere.security.jwt.JwtConsumer jwtConsumer = JwtConsumer.create("jwtConsumer_configuration_id"); ---- -- Verify and parse a JWT token by implementing the `com.ibm.websphere.security.jwt.JwtToken` API. +2 . Verify and parse a JWT token by implementing the `com.ibm.websphere.security.jwt.JwtToken` API. [source, java] ----