When setting up a named credential, there are two authentication protocols related to JWT:
- JWT
- JWT Token Exchange
What's the different between them? Is there detailed documentation on them? My project uses JWT token to authenticate to an API server. The server side decides on the authentication mechanism. The JWT token is generated with a shared key given by the server side. My team wrote Apex code to generate the token. I'd prefer to use named credential if possible. So does JWT or JWT Token Exchange support shared key? Thanks!
5 comments
Out of the box, Named Cred issuing a JWT doesn't support symmetric keys, perhaps because SF's own oAuth implementation doesn't support symmetrically signed JWTs for inbound calls. Nevertheless, it's a valid use case for non-SF apps and it'd be nice if Named Creds did this. RFC7518 lists the algorithms and whether they are required, recommended or optional for a JWT library. HS256 (HMAC with SHA-256, a symmetric scheme) is on the list as required.
