https://www.ory.sh/ logo
Join Slack
Powered by
We are trying to configure oathkeeper in a way, so...
# talk-oathkeeper
a
We are trying to configure oathkeeper in a way, so that it is sending a proper JWT to our backend system as a Bearer token. From what I understand, we need to use an id_token mutator? But what is the correct way to configure it, so that the token can be properly validated by the backend system agains Ory? I understand that oathkeeper is creating and encrypting the JWT itself? Does oathkeeper then need the same private key in it’s JSKs, that Ory is using? And how do I set that up? Or am I completely misunderstanding how it works? Is there a documentation for this scenario that I didn’t find?
i
It depends on what you mean by proper JWT. If you mean, oauthkeeper should create a JWT out of the subject information of the request it has authenticated so far, then yes, you should use the 
id_token
mutator. It configuration and usage is described in https://www.ory.sh/docs/oathkeeper/pipeline/mutator#id_token
But what is the correct way to configure it, so that the token can be properly validated by the backend system agains Ory?
As you can see from the docs referenced above, the 
id_token
mutator requires a 
jwks_url
where it retrieves the key material (can be a local file) used for JWT signing purposes. Your backend system, which has to deal with these JWTs needs a way to access the corresponding key material as well. One way to achieve that is to let your backend use the https://www.ory.sh/docs/oathkeeper/reference/api#tag/api/operation/getWellKnownJSONWebKeys endpoint of oathkeeper to retrieve that key. Or make it statically available to you backend (not recommended, as you'll introduce dependencies and key rotation will be come a hard challenge)
I understand that oathkeeper is creating and encrypting the JWT itself?
As I've written above - yes. But it only signs the JWT
Does oathkeeper then need the same private key in it’s JSKs, that Ory is using?
Actually it is up to you, which keys to use. And, actually, no, you should provide your own key material (at least this is the recommended approach).
And how do I set that up? Or am I completely misunderstanding how it works? Is there a documentation for this scenario that I didn’t find?
I now assume, you can gather the missing information from the links provided above. IMO it describes everything in detail
16 Views
Open in Slack
PreviousNext
Powered by