CODEWITHSUNDEEP
authenticationjwtarchitecturepingpingfederate
nidhi vyas
nidhi vyas

Reputation: 1

JWT Architecture with granular access and PingFederate

I need help with understanding complete JWT Architecture using Public-Private keys. Our goal is explained below- Authentication will be initiated from an App. We are planning to generate token at client's end using Java JJWT library signed by Client's private key. Send that to PingFederate only to validate the signature using Public key. After Ping has validated the signature we would directly provide access to Resource API.

Questions :

  1. Is it possible that PingFederate can validate the token which it has not generated.
  2. Is this approach correct to allow access to Resource API once Ping has validated the signature of the JWT token. Or we again nee dto get an Access token.
  3. Is this a security breach that we allow access based on the JWT token.
  4. If we use PingFederate just to validate teh signature, then the Ping's capabilities will be used properly.

enter image description here

Added the image to describe our proposed solution.

Upvotes: 0

Views: 72

Answers (0)

Related Questions