GenerateJWT only for JWT Tokens of Apigee

[surekhavuchuru]

Hi,

According to the documentation found at https://cloud.google.com/apigee/docs/api-platform/reference/policies/generate-jwt-policy, I am uncertain whether the JWT token generated by Apigee is solely issued by Apigee.

In the VerifyJWT policy, it is possible to validate the JWT token from EntraID. I would like to clarify whether the GenerateJWT policy can be utilized to create a JWT token from EntraID, or if I need to employ a ServiceCallOut to generate the JWT token from EntraID.

Thanks,

Surekha

[dchiesa1 · Accepted solution]

---

@surekhavuchuru wrote:

I am uncertain whether the JWT token generated by Apigee is solely issued by Apigee.

---

I am not clear on the question you are asking. [I will suppose that, for the rest of this discussion, we are discussing a signed JWT, using asymmetric signing algorithms (RSA or ECDSA). That means a private key is used to sign, and the matching public key will be used to verify.  If this is not correct, please advise. ]

If you use the GenerateJWT policy, you are telling Apigee to generate a JWT.  Therefore the "signer" will be Apigee, using the private signing key you provide.  Will it be "issued by" Apigee?  I dunno.  That depends on your situation.  In JWT there is an "iss" claim which asserts the issuer.  You can insert whatever you like in that claim.  "iss" can be "Jesse Owens" if you want.   Does that mean Jesse Owens issued the resulting token?  I guess it depends on what you mean by "issued" and "issuer", and what meaning you impute to the "iss" claim.

A verifying party should first verify the signature, and check that the JWT is not expired. The verifier ought to also look at

• the key that can be used to verify the signature.  Often, the key is published on a well-known JWKS endpoint.  Something like www.issuing-party.com/.well-known/JWKS.json  . If you get your public key from a URL like that, you can be certain that the organization that owns issuing-party.com "owns" the public key, and presumably the matching private key.  This check is therefore implicit:  when you verify  a JWT with that JWKS URI, you can be sure that issuing-party.com was the signer. (This  may or may not be the same as "issuer", see my comments above).
• The issuer (iss claim), maybe.  Depends on if your app or system considers this claim to be meaningful.
• The audience (aud claim).  To make sure the token is intended to be consumed by the verifying party. 
• any other meaningful claims. 

---

@surekhavuchuru wrote:

In the VerifyJWT policy, it is possible to validate the JWT token from EntraID. I would like to clarify whether the GenerateJWT policy can be utilized to create a JWT token from EntraID,

---

Absolutely not.  Apigee cannot "generate a token from EntraID" .  Only EntraID has the private key that is used to sign JWTs from EntraID.   It is not possible for other signers to sign JWT that claim to be from EntraID.   This is the basis for trust of digital signatures in general. 

Here's an analogy: am I able to sign a mortgage document on your behalf?  Could I take out a loan, signing YOUR name to a document? No.  That's not permitted.  Well, I could sign your name, but it would be legally invalid.  Any party verifying the signature would see "this signature is not valid."   And similarly, your Apigee API proxy cannot sign a digital document that is from EntraID.   You could create a JWT with the "iss" claim pointing to some EntraID urn, but any party verifying the signature would see that it was not signed with a key owned by EntraID. 

ok, so I hope that clears things up.

But WHY Are you asking these questions? What  would be the purpose of Apigee "creating" a JWT "from Entra ID" ?  It's not possible, but why would you want that?

---

@surekhavuchuru wrote:

if I need to employ a ServiceCallOut to generate the JWT token from EntraID.

---

If you want a JWT signed by EntraID, you need to ask EntraID to provide that.  ServiceCallout is a good way to make that request.

[surekhavuchuru]

Hi Dino,

Thanks for answering.

But WHY Are you asking these questions? What  would be the purpose of Apigee "creating" a JWT "from Entra ID" ?  It's not possible, but why would you want that?

I wanted to verify whether GenerateJWT or ServiceCallOut could be used to generate a token from EntraID. However, the explanation you provided has clarified my concerns.

Thanks,

Surekha