wso2-am 2.1.0 jwt token expiration

Question

Using WSO2AM 2.1.0 we'd like to use the JWT token to pass api, user and application information to the backend service for authorization. The problem is with the JWT validation as the expiration timestamp is set to the current timestamp

reading other resources did not help much:

Content of the api-manager.xml

<CacheConfigurations>
    <EnableGatewayTokenCache>true</EnableGatewayTokenCache>
    <EnableGatewayResourceCache>true</EnableGatewayResourceCache>
    <JWTClaimCacheExpiry>900</JWTClaimCacheExpiry>
...

<APIKeyValidator>
    ...
    <JWTExpiryTime>900</JWTExpiryTime>
    <SecurityContextTTL>900</SecurityContextTTL>
</APIKeyValidator>

(even according to the resources the JWTExpiryTime has no effect when KM or GW cache is enabled)

It looks like the JWTExpiryTime is in effect if the token cache is disabled (to be validated), but we would like to cache the access tokens for performance reasons..

Edit: seems if either (Gateway or KeyManager) token cache is enabled, the JWT expiration is simply set to current timestamp (making JWT token unusable without some agreement on backend services about the token leeway/skew time). The token is cached for cache-lifetime (15mins by default), so the backend must allow expired tokens for 15 minutes. Or am I missing something?

Tharika Madurapperuma Tharika Madurapperuma · Accepted Answer · 2018-06-19T12:24:03

It looks like the JWTExpiryTime is in effect if the token cache is disabled (to be validated)

You are correct here. You can set the JWT expiration Timestamp using JWTExpiryTime in {APIM_HOME}/repository/conf/api-manager.xml only when both Gateway and Key Manager cache are disabled.

But if you want the token cache to be kept enabled while preventing your JWT from expiring at the time of JWT generation, you can set the TokenCacheExpiry property in api-manager.xml under CacheConfigurations section as follows.

<CacheConfigurations>
    ...
    <TokenCacheExpiry>900</TokenCacheExpiry>
    ...
</CacheConfigurations>

With this property you define the cache expiry time duration for the Gateway or the Key Manager, the default being 900(seconds).

For more information, refer the following documentation.

wso2-am 2.1.0 jwt token expiration

1 Answers