Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a JWT (JSON Web Token); where is it used in TR7?
Short answer
JWT (JSON Web Token) is a token format that consists of three parts separated by dots: header, payload and signature (RFC 7519). The header and the payload are JSON encoded with Base64URL; the payload carries user and permission information as claims, while the signature is used to verify that the token has not been modified and who produced it. A standard JWT is signed but not encrypted; anyone can read its payload. It is used in two places in TR7: JWT Header Query and JWT Payload Query in the Smart Variable functions read a value with a JSON path from the header and payload part of a token carried in a header or in a cookie; this value is used in conditions, actions and persistence keys. In AGS, the ID token returned by the OpenID Connect provider is a JWT, and its signature is verified with the keys at the JWKS URI address.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Fields where Smart Variable is used → Add Variable window → Add Functions | JWT Header Query, JWT Payload Query; argument JSON path (default $.key) | Building a condition, action or persistence key based on a value in the token (e.g., username, role) |
| AGS → Authentication → Authentication Providers (OpenID Connect) | JWKS URI, Skip Signature Verification (off by default) | Verification of the ID token signature |
| Same form (OAuth2, OpenID Connect) | Custom User Attribute Mapping; JSONata context Identity Claims (OAuth2 / OIDC) | Mapping of the ID token claims to AGS user fields |
Parts
| Part | Content | Smart Variable function |
|---|---|---|
| Header | Signature algorithm (alg), key ID (kid), type | JWT Header Query |
| Payload | Claims: user (sub), issuer (iss), validity period (exp), scope | JWT Payload Query |
| Signature | The signature of the header and payload | - |
Common Misconceptions
- "The JWT content is encrypted." A standard JWT is only signed; the payload can be read by decoding the Base64URL, which is why sensitive data is not put in the token.
- "JWT payload query verifies the token." The function only reads the value at the specified path; the token's signature and lifetime are not validated with this function. The validity of the token is verified in the system that produced it or in the application that accepts the token.
- "Every token is a JWT." Depending on the provider, access tokens can also be an opaque value; JWT functions give a meaningful result only for tokens in JWT format (What is the difference between an access token and an ID token?).
How it is done in the documentation
