Question
Fujifilm
HK
Last activity: 13 May 2024 12:16 EDT
JWT Authentication
A User gets authenticated in service A via Identity Provider by OAuth2/OpenID Connect and get JWT. How can Pega application use the JWT for SSO authentication?
***Edited by Moderator Rupashree S. to add Capability tags***
Pegasystems Inc.
IN
@Andrew Hui When integrating Pega applications with OAuth2/OpenID Connect for Single Sign-On (SSO), you can use the JSON Web Token (JWT) obtained during authentication. Here’s how you can achieve this:
-
Configure an Authentication Profile:
- In your Pega application, create an authentication profile that uses the OAuth2 JWT bearer grant type1.
- In the JWT assertion section of the authentication profile, specify the source of the JWT for generating the access token request.
- To use the JWT from the OAuth2 identity provider (such as the one used for SSO), select “Use token from active SSO session.”
-
JWT Usage in Pega:
@Andrew Hui When integrating Pega applications with OAuth2/OpenID Connect for Single Sign-On (SSO), you can use the JSON Web Token (JWT) obtained during authentication. Here’s how you can achieve this:
-
Configure an Authentication Profile:
- In your Pega application, create an authentication profile that uses the OAuth2 JWT bearer grant type1.
- In the JWT assertion section of the authentication profile, specify the source of the JWT for generating the access token request.
- To use the JWT from the OAuth2 identity provider (such as the one used for SSO), select “Use token from active SSO session.”
-
JWT Usage in Pega:
- Once the authentication profile is configured, Pega will automatically handle the JWT during SSO.
- When a user logs in via the Identity Provider (IdP), the IdP generates a JWT containing user information.
- Pega extracts the JWT from the SSO session and uses it to authenticate the user within the Pega application.
Fujifilm
HK
@Manojkumar_ J Sorry for late reply. Thanks for your reply. I created JWT profile as suggested, and I try to go to standard Pega login and add the UserId into Pega as Operator. However, Pega still asks for username and password. Do I need to create a custom Authentication Service to use the JWT from Authentication Profile?