JWT Provider Management 🆕¶

Note

JWT provider endpoints allow configuring upstream token issuers that authenticate Fudo Enterprise users on the request’s behalf. A request that carries a signed JWT in the configured HTTP header is verified against the keys published by the issuer, and the claim named by username_claim is mapped to an existing user.

Data Structures¶

`JWTProviderModel`¶
Attribute	Type	Required	Description
`id`	string		Read-only. Unique ID of the JWT provider.
`name`	string	yes	Unique. JWT provider name (case-insensitive).
`enabled`	boolean; default value `true`	yes	Enable or disable this provider. Disabled providers are ignored during verification.
`issuer`	string	yes	Unique. Expected issuer (`iss`) claim, used to match an incoming JWT to this provider. Must start with `https://`.
`jwks_uri`	string		HTTPS URI of the JSON Web Key Set. If omitted, discovered via the issuer’s OpenID Configuration at `<issuer>/.well-known/openid-configuration`.
`audience`	string	yes	Expected audience (`aud`) claim. JWTs with a different audience are rejected.
`username_claim`	string; default value `sub`	yes	JWT claim that contains the Fudo Enterprise user name.
`fudo_domain`	string		Fudo domain to scope the user lookup.
`header`	string; default value `Authorization`	yes	HTTP header that carries the JWT. Configure when fronted by a WAF that injects JWTs into a custom header, for example `X-JWT-Assertion`.
`keys_updated_at`	datetime		Read-only. Timestamp of the last successful key refresh.
`keys`	object-array of `JWTProviderKeyModel`		Read-only; expensive to use. Cached signing keys fetched from the provider’s JWKS endpoint. Returned only when requested explicitly.
`created_at`	datetime		Read-only. Timestamp of creation.
`modified_at`	datetime		Read-only. Timestamp of modification.
`removed`	boolean		Read-only.

`JWTProviderKeyModel`¶
Attribute	Type	Description
`kid`	string	Read-only. Key identifier published by the issuer. Used to select the key when a token carries the `kid` header. Empty when the issuer publishes a single unnamed key.
`kty`	string {RSA, EC, OKP}	Read-only. Key type. It has to match the algorithm family of the token: `RSA` for `RS`, `EC` for `ES`, `OKP` for `EdDSA`.
`alg`	string	Read-only. Algorithm declared for this key by the issuer. Empty when the issuer does not declare one.
`public_key`	string	Read-only. Public key converted to the PEM format.

Retrieve Available Attributes of the JWTProviderModel¶

Request

Method	`GET`
Path	`/api/v2/objspec/jwt_provider`

GET /api/v2/objspec/jwt_provider

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/objspec/jwt_provider'

List JWT Providers¶

Retrieve all configured JWT providers.

Request

Method	`GET`
Path	`/api/v2/jwt_provider`

GET /api/v2/jwt_provider

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/jwt_provider'

Response

{
    "result": "success",
    "jwt_provider": [
        {
            "id": "2044634230826205185",
            "name": "BIG-IP APM",
            "enabled": true,
            "issuer": "https://apm.example.com",
            "jwks_uri": "https://apm.example.com/f5-oauth2/v1/jwks",
            "audience": "fudo",
            "username_claim": "preferred_username",
            "header": "X-JWT-Assertion",
            "created_at": "2026-08-06 10:58:29.657182-07",
            "modified_at": "2026-08-06 10:58:29.657182-07"
        }
    ]
}

Note

The keys attribute is expensive to use and is not returned unless it is requested explicitly. Refer to Get Cached Signing Keys.

Get JWT Provider Details¶

Retrieve details of a specific JWT provider.

Request

Method	`GET`
Path	`/api/v2/jwt_provider/<id>`

GET /api/v2/jwt_provider/<id>

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/jwt_provider/2044634230826205185'

Response

{
    "result": "success",
    "jwt_provider": {
        "id": "2044634230826205185",
        "name": "BIG-IP APM",
        "enabled": true,
        "issuer": "https://apm.example.com",
        "jwks_uri": "https://apm.example.com/f5-oauth2/v1/jwks",
        "audience": "fudo",
        "username_claim": "preferred_username",
        "header": "X-JWT-Assertion",
        "created_at": "2026-08-06 10:58:29.657182-07",
        "modified_at": "2026-08-06 10:58:29.657182-07"
    }
}

Get Cached Signing Keys¶

Retrieve the signing keys currently cached for a provider. The keys attribute is expensive to use, so it is returned only when it is requested explicitly.

Request

Method	`GET`
Path	`/api/v2/jwt_provider/<id>?fields=id,name,keys_updated_at,keys`

GET /api/v2/jwt_provider/<id>

Example Request

curl -s -k -X GET \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/jwt_provider/2044634230826205185?fields=id,name,keys_updated_at,keys'

Response

{
    "result": "success",
    "jwt_provider": {
        "id": "2044634230826205185",
        "name": "BIG-IP APM",
        "keys_updated_at": "2026-08-07 01:32:33.169214-07",
        "keys": [
            {
                "alg": "RS256",
                "kid": "b6dd51e66d36010bd3bbdfb3c91a1a5f6ec6c12c",
                "kty": "RSA",
                "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END PUBLIC KEY-----\n"
            }
        ]
    }
}

Note

An empty keys array together with an empty keys_updated_at means that no key has been fetched yet. Refer to the events log for the reason.

Create JWT Provider¶

Add a new JWT provider configuration.

Request

Method	`POST`
Path	`/api/v2/jwt_provider`
Headers	`Content-Type: application/json`
Body	`JWTProviderModel`

POST /api/v2/jwt_provider

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "BIG-IP APM",
    "enabled": true,
    "issuer": "https://apm.example.com",
    "audience": "fudo",
    "jwks_uri": "https://apm.example.com/f5-oauth2/v1/jwks",
    "header": "X-JWT-Assertion",
    "username_claim": "preferred_username"
  }' \
  'https://10.33.2.132/api/v2/jwt_provider'

Success Response

{
    "result": "success",
    "jwt_provider": {
        "id": "2044634230826205185"
    }
}

Failure Response

{
    "result": "failure",
    "message": "Issuer must start with https://.",
    "failing_attributes": [
        "issuer"
    ]
}

Update JWT Provider¶

Modify an existing JWT provider configuration.

Request

Method	`PATCH`
Path	`/api/v2/jwt_provider/<id>`
Headers	`Content-Type: application/json`
Body	`Partial JWTProviderModel`

PATCH /api/v2/jwt_provider/<id>

Example Request

curl -s -k -X PATCH \
  -H 'Authorization: <token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "audience": "fudo-uag"
  }' \
  'https://10.33.2.132/api/v2/jwt_provider/2044634230826205185'

Response

{
    "result": "success"
}

Refresh Signing Keys¶

Fetch the signing keys of all configured JWT providers again, for example after an issuer has rotated them. Keys are fetched by every cluster node on its own.

Request

Method	`POST`
Path	`/api/v2/jwt_provider/refresh_keys`

POST /api/v2/jwt_provider/refresh_keys

Note

This endpoint takes no request body. A request that carries one is rejected with Request body is not allowed for this endpoint.

Example Request

curl -s -k -X POST \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/jwt_provider/refresh_keys'

Response

{
    "result": "success"
}

Note

The response confirms that the refresh has been started, not that the keys have been fetched. When an issuer cannot be reached, the failure is recorded in the events log and the keys_updated_at attribute of that provider stays unchanged.

Delete JWT Provider¶

Remove a JWT provider configuration.

Request

Method	`DELETE`
Path	`/api/v2/jwt_provider/<id>`

DELETE /api/v2/jwt_provider/<id>

Example Request

curl -s -k -X DELETE \
  -H 'Authorization: <token>' \
  'https://10.33.2.132/api/v2/jwt_provider/2044634230826205185'

Response

{
    "result": "success"
}