JWT Secured Authorization Response Mode (JARM) for OAuth 2.0
# JWT Secured Authorization Response Mode (JARM) for OAuth 2.0
The JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) specification defines new JWT-based modes to encode OAuth2 authorization responses. These modes allow clients to request authorization response parameters and additional data in JWT format.
# Authorization flow
Below is a sample authorization request sent to the authorization endpoint of Asgardeo.
https://api.asgardeo.io/t/<organization_name>/oauth2/authorize?
prompt=login
&scope=openid
&redirect_uri=https://<CLIENT_HOST>/redirects/redirect1
&client_id=<CLIENT_ID>
&response_type=<RESPONSE_TYPE>
&response_mode=<RESPONSE_MODE>
2
3
4
5
6
7
The parameters used in the authorization request are defined below.
Parameter | Description |
---|---|
reponse_type |
Informs Asgardeo of the desired OAuth2 authorization processing flow, which determines the type of authorization information that should be returned. Possible values:
|
response_mode |
Specifies how the authorization information should be returned to the client. By default, the following response modes are supported in Asgardeo:
|
# JARM response modes
Using JARM, clients can request authorization response parameters along with additional data in the JWT format instead of plain text.
The specification defines the following response modes, which you can specify using the response_mode
parameter in the authorization request.
# query.jwt
Response parameters are encoded in a single JWT and sent as a query parameter to the redirect URI.
Sample response:
HTTP/1.1 302 Found
Location: https://<CLIENT_HOST>/redirects/redirect1?response={JWT};
2
# fragment.jwt
Response parameters are encoded in a single JWT and sent as a fragment parameter to the redirect URI.
Sample response:
HTTP/1.1 302 Found
Location: https://<CLIENT_HOST>/redirects/redirect1#response={JWT};
2
# form_post.jwt
The response parameter containing the JWT is encoded as an HTML form value that is auto-submitted in the user-agent and thus is transmitted via the HTTP POST method to the client, with the result parameters being encoded in the body.
Sample response from the authorization server to the user agent:
HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Cache-Control: no-cache, no-store
Pragma: no-cache
<html>
<head><title>Submit Form</title>
</head>
<body onload="javascript:document.forms[0].submit()">
<form method="post" action="https://<CLIENT_HOST>/redirects/redirect1">
<input type="hidden" name="response" value={JWT}/>
</form>
</body>
</html>
2
3
4
5
6
7
8
9
10
11
12
13
14
The above response results in the following POST request to the client's redirect URI:
POST /redirects/redirect1 HTTP/1.1
Host: <CLIENT_HOST>
Content-Type: application/x-www-form-urlencoded
response={JWT};
2
3
4
5
# jwt
The jwt
response mode is a shortcut that indicates the default redirect encoding for the requested response as follows.
- If the response type is
code
, the defaultresponse_mode
isquery.jwt
. - For the response types defined in OIDM (except
none
), the default response mode isfragment.jwt
. - For response types containing
token
orid_token
, the default response mode isfragment.jwt
.
Given below is a sample JARM response {JWT}:
eyJ4NXQiOiJNell4TW1Ga09HWXdNV0kwWldObU5EY3hOR1l3WW1NNFpUQTNNV0kyTkRBelpHUXpOR00wWkdSbE5qSmtPREZrWkRSaU9URmtNV0ZoTXpVMlpHVmxOZyIsImtpZCI6Ik16WXhNbUZrT0dZd01XSTBaV05tTkRjeE5HWXdZbU00WlRBM01XSTJOREF6WkdRek5HTTBaR1JsTmpKa09ERmtaRFJpT1RGa01XRmhNelUyWkdWbE5nX1JTMjU2IiwiYWxnIjoiUlMyNTYifQ.ewogICJhdWQiOiAieVQyZkNBaWNRODNRWXltRWpDMGEwZnBqZWM4YSIsCiAgImNvZGUiOiAiNDRjZTU3NTctN2Y1NC0zYjFlLWEzM2YtMThhMzA2MTU1MDUzIiwKICAiaXNzIjogImh0dHBzOi8vYXBpLmFzZ2FyZGVvLmlvL2JpZnJvc3Qvb2F1dGgyL3Rva2VuIiwKICAiZXhwIjogMTY4MDA5MDUwMiwKICAic2Vzc2lvbl9zdGF0ZSI6ICI3ZDg1MjdhNmNmMDU2N2UyNDkxZjE4YmRmZWE2ZTkwYjE0OWZhMjk1MGQ5MmRiYjMxMGI1NDIxOWI3MzNlNDgxLnNwdUVZVUJtUF9FTGVUZEtQX2U3SkEiCn0=.wYIBpEIhYdFq4W3mrx4gcAI2kSgJ5viQ6qGntHsIRMT2wg9F4d-DzMEkMvy4tOup2dlZNby80Sf1djuG44Z-1xbellcuk7hRfotlMOjSLc7fmkzy0b4HvwcN66U9wETWQfixUTbWbOvmqMqzdMQKtSB2b7oWEh5EHOlQQ6vrGJc2eSxquMN_O17PlYKF0smXSgoESIunf8k5sGydO8MvwVZ4-qfqnx7Lx7Huk36CfW-CFI0IXIehi017onOx0FOXwRaizMM45M0zfzyvg4CbZUaGPeGuyO7DVsUPwjdkrjkhiKcXR61S01uqj8-_AAgtZMJHMI3yJQmvWM4ezNe9_Q
Decoded payload:
{
"aud": "yT2fCAicQ83QYymEjC0a0fpjec8a",
"code": "44ce5757-7f54-3b1e-a33f-18a306155053",
"iss": "https://api.asgardeo.io/bifrost/oauth2/token",
"exp": 1680090502,
"session_state": "7d8527a6cf0567e2491f18bdfea6e90b149fa2950d92dbb310b54219b733e481.spuEYUBmP_ELeTdKP_e7JA"
}
2
3
4
5
6
7