Share via

4.4 Security Token Self-Issued By Client with User Information

  • Article

In this example, the client tries to access a resource on the server. The server responds with an HTTP 401 challenge that indicates the security token issuers it trusts in the trusted_issuers field. An example of such a challenge is as follows.

 HTTP/1.1 401 Unauthorized
 Server: Fabrikam/7.5
 request-id: 443ce338-377a-4c16-b6bc-c169a75f7b00
 X-FEServer: DUXYI01CA101
 WWW-Authenticate: Bearer client_id="00000002-0000-0ff1-ce00-000000000000", trusted_issuers="00000001-0001-0000-c000-000000000000@*"
 WWW-Authenticate: Basic Realm=""
 X-Powered-By: ASP.NET
 Date: Thu, 19 Apr 2012 17:04:16 GMT
 Content-Length: 0

  1. The client is one of the token issuers trusted by the server, so it creates an actor token and signs it with its credentials.

  2. The client constructs an unsigned outer token that contains additional user information to provide to the server. The outer token also contains the signed actor token issued by the client.

  3. The client uses the outer token to access the resource it requested on the server.

The following is an example of an outer token that is constructed by the client and contains user information, as well as a security token that is self-issued by the client. For more information about the claim values contained in this security token, see section 2.2.

 {
     "typ":"JWT",
     "alg":"none"
 }.{
     "aud":"00000003-0000-0ff1-ce00-000000000000/contoso.com@EXHB-88371dom.extest.contoso.com",
     "iss":"00000002-0000-0ff1-ce00-000000000000@EXHB-
88371dom.extest.contoso.com",
     "nbf":"1323380605",
     "exp":"1323409405",
     "nameid":"ewsuser-55a83300@EXHB-88371dom.extest.contoso.com",
     "smtp":"ewsuser-55a83300@exhb-88371dom.extest.contoso.com",
     "sip":"ewsuser-55a83300@exhb-88371dom.extest.contoso.com",
     "msexchuid":"842e4c3a-0879-4973-83f9-495bb9863e18@exhb-88371dom.extest.contoso.com",
     "actort":"..actor token.."
 }

The following is an example of an actor token, as mentioned in the previous listing.

 {
     "typ":"JWT",
     "alg":"RS256",
     "x5t":"hEAw-SXzTNaDBUwfAh2YScnBOxA"
 }.{
     "aud":"00000002-0000-0ff1-ce00-000000000000/contoso.com@EXHB-88371dom.extest.contoso.com",
     "iss":"00000003-0000-0ff1-ce00-000000000000@e54c2f60-0ad3-4ef8-8ba2-b3ae01b35494",
     "nbf":"1346674665",
     "exp":"1346804265",
     "nameid":"00000003-0000-0ff1-ce00-000000000000@e54c2f60-0ad3-4ef8-8ba2-b3ae01b35494"
 }