Signing Provider Configuration for JOSE and OAuth

Follow these instructions for each provider. Replace the indicated value with the appropriate JCA provider name.

On this page:

JOSE Security Policy v2 - Configuring the crypto provider

Configure the cryptographic provider that JOSE Security Policy v2 uses for encryption, decryption, signing, and signature verification.

To configure JOSE v2 crypto provider:

  1. Log in to the Akana Administration Console.
  2. Go to the Configuration tab.
  3. Under Configuration Categories, select com.akana.jose.config.
  4. Specify the value for your provider in each of the following fields:
    • Decryption: jose.v2.security.handler.factory.cryptoProviderDecrypt
    • Encryption: jose.v2.security.handler.factory.cryptoProviderEncrypt
    • Signing: jose.v2.security.handler.factory.cryptoProviderSign
    • Signature verification: jose.v2.security.handler.factory.cryptoProviderVerify
  5. Use the value that corresponds to your cryptographic provider:
    • Entrust HSM: nCipherKM
    • AWS CloudHSM: Cavium
    • Bouncy Castle Provider: BC
  6. Select Apply Changes.

For more information, see Using the JOSE Security Policy v2.

JOSE Profile-Driven Policy - Configuring the crypto provider

Specify the following crypto provider fields in your policy XML to enable JOSE profile-driven policy. The primary crypto provider is set to nCipherKM.

<rsa:profileName>RSA-AAEC-3.2</rsa:profileName>
        <rsa:cryptoProviderSign>nCipherKM</rsa:cryptoProviderSign>
        <rsa:cryptoProviderVerify>BC</rsa:cryptoProviderVerify>
        <rsa:cryptoProviderDecrypt>nCipherKM</rsa:cryptoProviderDecrypt>
        <rsa:cryptoProviderEncrypt>SunJCE</rsa:cryptoProviderEncrypt>

For more information, see Using the JOSE Profile-Driven Security Policy.

OAuth Client Policy - Configuring signing JCA provider for OAuth client authentication

Configure the Signing JCA Provider field in the Client JWT Assertion when using Private Key JWT authentication. Use the value appropriate for your signing configuration:

  • For HSM/External Keystore: Enter the HSM's JCA provider (For example, nCipherKM for Entrust).
  • For Standard Installation: Use SunJCE or BC, or leave blank to allow the platform to select the provider.

Related options:

  • Replay Prevention: Generates a unique JWT for each request.
  • Private Key JWT: Available in version 2024.1.2 and later for signing client assertion JWT with assigned private key when stored in HSM.

For more information, see Using the OAuth Client Policy.

Akana OAuth/OIDC Provider - Configuring JWT token encryption and decryption

Configure the following fields in the Token tab to enable JWT token encryption and signing.

Signing fields:

Field Description
JWT Signing Algorithm Select signing algorithm (e.g., RS256, HS256).
Signing JCA Provider Select JCA provider: SunJCE, BouncyCastle, or nCipher (for HSM).
Verify JCA Provider Select JCA provider for verification. Use same provider as Signing JCA Provider.

Encryption fields:

Field Description
Encrypt JWT Access Token Enable to encrypt tokens.
Encrypt JCA Provider Select JCA provider: SunJCE, BouncyCastle, or nCipher (for HSM).
Decrypt JCA Provider Select JCA provider for decryption. Use same provider as Encrypt JCA Provider.

For more information, see Akana OAuth/OIDC Provider Domain.

External OAuth Provider - Configuring provider settings

Configure the encryption and decryption settings for your External OAuth Provider on the Access Token Validation tab, including support for encrypting tokens and managing JCA provider configuration.

Field Description
Supports Encryption Enable encryption support for this provider.
Reference encryption keys from an existing platform identity Select an existing platform identity to use its encryption keys.
Decrypt JCA Provider Specify the JCA provider used for decrypting tokens (For example, nCipherKM).
If you need Bouncy Castle as a fallback provider for algorithms not supported directly by the Entrust HSM, you can register it as an additional provider. To Register Bouncy Castle as a Fallback Provider, ensure Bouncy Castle is registered as a JCA provider on your JVM, see Java Virtual Machine (JVM)/Java Cryptography Extension (JCE) provider setup. In the policy field where you need Bouncy Castle support, specify: BC. Reference BC in specific policy fields, rather than using nCipherKM for operations that require fallback support.

For more information, see External OAuth Provider Domain.