JWT Class

Properties   Methods   Events   Config Settings   Errors  

Create, Sign, Encrypt, Verify and Decrypt JSON Web Tokens (JWTs).

Syntax

JWT

Remarks

The JWT class supports signing, encrypting, decrypting and verifying JSON Web Tokens (JWTs).

Specify a set of claims via the Claim* properties or add your own claims with AddClaim. Call Sign to create a signed JWT using a variety of signing algorithms including HMAC, RSA, and ECDSA. Use Verify to verify the signature of any received JWT. See SigningAlgorithm for more details about supported algorithms.

Use Encrypt to create an encrypted JWT using a variety of algorithms including ECDH, RSA, and AES. Use Decrypt to decrypt the payload of any received JWT. See EncryptionAlgorithm for more details about supported algorithms.

Signing

The Sign method may be used to sign a payload with a variety of algorithms. Before calling the Sign method set SigningAlgorithm to the algorithm which will be used to sign the message. The result of signing is a compact serialized JWT string. For instance:

eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOlsiYXVkaWVuY2UiXSwiaXNzIjoiaXNzdWVyIn0.mlFETSma4WUcUSjNSUWA1n9QBcQHCkHN-y4zeBsCVqI

The class will use the values present in the Claim* properties to build the encoded JWT. After calling this method the EncodedJWT property will hold the compact serialized JWT. The following properties are applicable when calling this method:

• SigningAlgorithm (required)
• Certificate (conditional - required for ECDSA and RSA)
• Key (conditional - required for HMAC)
• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• HeaderParams
• KeyId

Notes for HMAC Algorithms (HS256, HS384, HS512)

When SigningAlgorithm is set to a HMAC algorithm Key must be set to a key of appropriate length for the algorithm. The Key should be the same number of bits as the algorithm being used. For instance a 256 bit key would be used for HS256.

The key must be known by both parties in order for signing and verification to take place. To use an existing HMAC key provide the bytes to the Key property. For instance:

//HMAC SHA-256 Key byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; //Sign the payload using HS256 Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saHS256; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.KeyB = key; jwt.Sign(); string signedData = jwt.EncodedJWT;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The private key may be in PFX or PEM format.

Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saRS256; jwt.Certificate = new Certificate(CertStoreTypes.cstPFXFile, "..\\jwt.pfx", "test", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Sign(); string signedMessage = jwt.EncodedJWT;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC private key in order to sign data. The Certificate property should be set to a certificate with an ECC key. The CertMgr class can be used to create a certificate with an ECC key.

//Create an ECC key with SHA-256 Certmgr mgr = new Certmgr(); mgr.Config("CertPublicKeyAlgorithm=ECDSA_P256"); mgr.CertStoreType = CertStoreTypes.cstPEMKeyFile; mgr.CertStore = "C:\\temp\\ecdsa.pem"; mgr.CreateCertificate("CN=ecdsa", 123); //Sign the payload using ES256 Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saES256; jwt.Certificate = new Certificate(CertStoreTypes.cstPEMKeyFile, "C:\\temp\\ecdsa.pem", "", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Sign(); string signedMessage = jwt.EncodedJWT;

Notes for Unsecured (none)

To create a JWS token without any security set SigningAlgorithm to jwtNone.

Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saNone; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Sign(); string unsecuredMessage = jwt.EncodedJWT;

Signature Verification

The Verify method may be used to verify a received JWS message. Before calling the Verify method set EncodedJWT to a valid compact serialized JWT. For instance:

eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOlsiYXVkaWVuY2UiXSwiaXNzIjoiaXNzdWVyIn0.mlFETSma4WUcUSjNSUWA1n9QBcQHCkHN-y4zeBsCVqI

The Key or SignerCert properties should be set to the HMAC key or public certificate respectively. If the correct Key or SignerCert is not known ahead of time the KeyId parameter of the SignerInfo event may be used to identify the correct key.

If this method returns without error verification was successful. If verification fails then this method fails with an error. After calling this method the claims will be parsed and the Claim* properties will be populated. The the HeaderParams property will contain the headers. Headers of the parsed message are also available through the HeaderParam event.

The following properties are applicable when calling this method:

• EncodedJWT (required)
• Key (conditional - required for HMAC)
• SignerCert (conditional - required for ECDSA and RSA)
• SigningAlgorithm (only if StrictValidation is True)
• StrictValidation
• ExpectedAudience (optional)
• ExpectedExp (optional)
• ExpectedIssuedAt (optional)
• ExpectedIssuer (optional)
• ExpectedJWTId (optional)
• ExpectedNotBefore (optional)
• ExpectedSubject (optional)

After calling this method the following properties are populated:

• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• ClaimSubject
• HeaderParams

Notes for HMAC Algorithms (HS256, HS384, HS512)

When verifying a message originally signed with a HMAC algorithm Key must be set to the same key used during signing. The key must be known by both parties in order for signing and verification to take place.

byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The public key is typically in PEM format.

Jwt jwt = new Jwt(); jwt.SignerCert = new Certificate("..\\jwt.cer"); jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC public key to verify the message. The PEM encoded public key may be used directly with the Certificate property. An example PEM encoded public certificate created by the CertMgr class:

-----BEGIN CERTIFICATE-----
MIIBETCBtaADAgECAgF7MAwGCCqGSM49BAMCBQAwEDEOMAwGA1UEAxMFZWNkc2EwHhcNMjMw
NzAzMTcwMjU3WhcNMjQwNzAyMTcwMjU3WjAQMQ4wDAYDVQQDEwVlY2RzYTBZMBMGByqGSM49
AgEGCCqGSM49AwEHA0IABGJv251JI7ITcq+fac9Z2yYkhTLSRhWGzBw1wEJZbs/8AZbVmvcy
4BzKSZEaTfBsCHIt3FLNgRLdugI+B65eQDYwDAYIKoZIzj0EAwIFAANJADBGAiEAzmH5LKKn
r4iy9kJvIlCslpcBHM/8k0XQaj13Zwhm2ocCIQD/cSiC4EuqRkxT4IKET7ko3iI5YUS+J5W5
/0xnxxxIpQ==
-----END CERTIFICATE-----

Jwt jwt = new Jwt(); jwt.SignerCert = new Certificate(CertStoreTypes.cstPublicKeyBlob, pubKey, "", "*"); jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Notes for Unsecured (none)

To parse a JWS token without any security call the Sign method without setting the Key or Certificate properties.

Jwt jwt = new Jwt(); jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Encrypting

The Encrypt method may be used to encrypt a payload with a variety of algorithms. To create an encrypted JWT JSON Web Encryption (JWE) is performed by first generating a random key used to encrypt the content. The content encryption key is used to encrypt the content using the algorithm specified by ContentEncryptionAlgorithm. The content encryption key is then encrypted itself using the algorithm specified by EncryptionAlgorithm. The content encryption key is not directly exposed in the API as it is randomly generated.

After calling this method the compact serialized JWT is written to EncodedJWT. For instance:

eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.4tcAnZJ00u4GY2kLOanPOL4CtvcfraZ8SIi6bOZ27qYBI2rHITPc1Q.c_9rCTdPn-saLCti2ZEyWQ.eLwqqo5BGNa70RlsvT-vTh7Gk0hjpJYY_9Zc39Vim_qEtjyMcxZygBpkfx9brzQr9rUbuiAhoCMXKip2-lKT6w.NkuLDPmWxWL4BaTWHWicIQ

The class will use the values present in the Claim* properties to build the encoded JWT. After calling this method the EncodedJWT property will hold the compact serialized JWT. The following properties are applicable when calling this method:

• EncryptionAlgorithm (required)
• Key (conditional - required for AES)
• KeyPassword (conditional - required for PBES)
• RecipientCert (conditional - required for ECDH and RSA)
• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• CompressionAlgorithm
• ContentEncryptionAlgorithm
• HeaderParams
• KeyId

Notes for AES Algorithms (A128KW, A192KW, A256KW, A128GCMKW, A192GCMKW, A256GCMKW)

When EncryptionAlgorithm is set to a AES algorithm Key must be set to a key of appropriate length for the algorithm. For instance a 256 bit key would be used for A256KW.

To use an existing AES key provide the bytes to the Key property. For instance:

byte[] key = new byte[] { 164, 60, 194, 0, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; //Encrypt the payload using A256KW Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaA256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for RSA Algorithms (RSA1_5, RSA-OEAP, RSA-OAEP-256)

The RSA based algorithms use asymmetric encryption. Encrypting is done with a public key and decryption is done with a private key. The public certificate should be in PEM (base64) format. For instance:

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate("..\\recipient.cer"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaRSA_OAEP; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for ECDH Algorithms (ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW)

ECDH algorithms require a valid ECC public key to encrypt the message. If the key was originally created with the ECC class the PEM encoded PublicKey may be used directly with the Certificate property. An example PEM encoded public certificate created by the ECC component:

-----BEGIN PUBLIC KEY-----
MIIBMjCB7AYHKoZIzj0CATCB4AIBATAsBgcqhkjOPQEBAiEA/////wAAAAEAAAAAAAAAAAAA
AAD///////////////8wRAQg/////wAAAAEAAAAAAAAAAAAAAAD///////////////wEIFrG
NdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n0mBLBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt
6zOg9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA
//////////+85vqtpxeehPO5ysL8YyVRAgEBA0EEIC5rbLp11Mnz6cBXLLriaDIov3rm8RAY
x/OR0bOKiff0cQy+sLVaxjseqFk/+Xvl4ORSv5Z6HdHv5GyEpA0UoA==
-----END PUBLIC KEY-----

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKeyFile, "", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaECDH_ES_A256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

To use an ECC public key created by other means the ECC class may be used to import the key parameters. Populate the Rx and Ry properties of the ECC component first to obtain the PEM formatted public key. For instance:

byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; nsoftware.IPWorksEncrypt.Ecc ecc = new nsoftware.IPWorksEncrypt.Ecc(); ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; string pubKey = ecc.Key.PublicKey; Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaECDH_ES_A256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for PBES Algorithms (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW

PBES algorithms derive a content encryption key from the KeyPassword property. Set KeyPassword to a shared secret.

Jwt jwt = new Jwt(); jwt.KeyPassword = "secret"; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaPBES2_HS512_A256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for Direct Shared Keys

When EncryptionAlgorithm is set to Direct the Key property must be set to a valid symmetric key that will be used directly by the ContentEncryptionAlgorithm. In this case a content encryption key is not generated randomly, the Key is used instead. The length of the specified Key must be valid for the selected ContentEncryptionAlgorithm. For instance:

byte[] key = new byte[] { 164, 62, 191, 60, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; Jwt jwt = new Jwt(); jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaDir; jwt.ContentEncryptionAlgorithm = JwtContentEncryptionAlgorithms.ceaA256GCM; jwt.KeyB = key; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Decrypting

The Decrypt method may be used to decrypt a received JWE message. Before calling the Decrypt method set EncodedJWT to a valid compact serialized JWT string. For instance:

eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.4tcAnZJ00u4GY2kLOanPOL4CtvcfraZ8SIi6bOZ27qYBI2rHITPc1Q.c_9rCTdPn-saLCti2ZEyWQ.eLwqqo5BGNa70RlsvT-vTh7Gk0hjpJYY_9Zc39Vim_qEtjyMcxZygBpkfx9brzQr9rUbuiAhoCMXKip2-lKT6w.NkuLDPmWxWL4BaTWHWicIQ

The type and format of the private key depends on the algorithm used to encrypt the data. The following table summarizes the relationship:

If this method returns without error decryption was successful. If decryption fails then this method fails with an error. After calling this method the payload will be present in the Claim* properties and the HeaderParams property will contain the headers. Headers of the parsed message are also available through the HeaderParam event.

The following properties are applicable when calling this method:

• Certificate (conditional - required for RSA and ECDH)
• EncodedJWT
• Key (conditional - required for AES)
• ContentEncryptionAlgorithm (only if StrictValidation is True)
• EncryptionAlgorithm (only if StrictValidation is True)
• HeaderParams
• StrictValidation

After calling this method the following properties are populated:

• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• ClaimSubject
• HeaderParams

Notes for AES Algorithms (A128KW, A192KW, A256KW, A128GCMKW, A192GCMKW, A256GCMKW)

To decrypt messages that use AES encryption Key must be set to a key of appropriate length for the algorithm. For instance a 256 bit key would be used for A256KW.

The key must be known by both parties in order for encryption and decryption to take place.

byte[] key = new byte[] { 164, 60, 194, 0, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for RSA Algorithms (RSA1_5, RSA-OEAP, RSA-OAEP-256)

The RSA based algorithms use asymmetric encryption. Encrypting is done with a public key and decryption is done with a private key. The certificate with private key must be specified. For instance:

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPFXFile, "..\\jwt.pfx", "password", "*"); jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for ECDH Algorithms (ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW)

ECDH algorithms require a valid ECC private key to decrypt the message. If the key was originally created with the ECC class the PEM encoded PrivateKey may be used directly with the Certificate property.

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPEMKeyFile, privKeyFile, "", "*"); jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

To use an ECC private key created by other means the ECC class may be used to import the key parameters. Populate the Rx, Ry, and KB properties of the ECC component first to obtain the PEM formatted public key. For instance:

nsoftware.IPWorksEncrypt.Ecc ecc = new nsoftware.IPWorksEncrypt.Ecc(); byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; byte[] k_bytes = new byte[] { 81, 65, 201, 24, 235, 249, 162, 148, 169, 150, 109, 181, 61, 238, 145, 122, 31, 30, 151, 94, 239, 90, 222, 217, 63, 103, 54, 2, 176, 232, 248, 168 }; ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; ecc.Key.KB = k_bytes; string privKey = ecc.Key.PrivateKey; Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPEMKeyBlob, privKey, "", "*"); jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for PBES Algorithms (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW

PBES algorithms derive a content encryption key from the KeyPassword property. Set KeyPassword to the shared secret.

Jwt jwt = new Jwt(); jwt.KeyPassword = "secret"; jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for Direct Shared Keys

When Direct encryption is used the Key property must be set to a valid symmetric key that will be used directly by the ContentEncryptionAlgorithm. For instance:

byte[] key = new byte[] { 164, 60, 194, 0, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Other Functionality

In addition to standard operations the class also supports a variety of other features including:

• Adding custom header parameters with AddHeaderParam
• Enforcing algorithm restrictions when verifying by setting StrictValidation
• Inspect the JWT without verifying or decrypting by calling Parse

Property List

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

Certificate Property (JWT Class)

The certificate used for signing or decrypting.

Syntax

• C++
• C
• Qt

IPWorksAuthCertificate* GetCertificate();
int SetCertificate(IPWorksAuthCertificate* val);

char* ipworksauth_jwt_getcerteffectivedate(void* lpObj);

char* ipworksauth_jwt_getcertexpirationdate(void* lpObj);

char* ipworksauth_jwt_getcertextendedkeyusage(void* lpObj);

char* ipworksauth_jwt_getcertfingerprint(void* lpObj);

char* ipworksauth_jwt_getcertfingerprintsha1(void* lpObj);

char* ipworksauth_jwt_getcertfingerprintsha256(void* lpObj);

char* ipworksauth_jwt_getcertissuer(void* lpObj);

char* ipworksauth_jwt_getcertprivatekey(void* lpObj);

int ipworksauth_jwt_getcertprivatekeyavailable(void* lpObj);

char* ipworksauth_jwt_getcertprivatekeycontainer(void* lpObj);

char* ipworksauth_jwt_getcertpublickey(void* lpObj);

char* ipworksauth_jwt_getcertpublickeyalgorithm(void* lpObj);

int ipworksauth_jwt_getcertpublickeylength(void* lpObj);

char* ipworksauth_jwt_getcertserialnumber(void* lpObj);

char* ipworksauth_jwt_getcertsignaturealgorithm(void* lpObj);

int ipworksauth_jwt_getcertstore(void* lpObj, char** lpCertStore, int* lenCertStore);
int ipworksauth_jwt_setcertstore(void* lpObj, const char* lpCertStore, int lenCertStore);

char* ipworksauth_jwt_getcertstorepassword(void* lpObj);
int ipworksauth_jwt_setcertstorepassword(void* lpObj, const char* lpszCertStorePassword);

int ipworksauth_jwt_getcertstoretype(void* lpObj);
int ipworksauth_jwt_setcertstoretype(void* lpObj, int iCertStoreType);

char* ipworksauth_jwt_getcertsubjectaltnames(void* lpObj);

char* ipworksauth_jwt_getcertthumbprintmd5(void* lpObj);

char* ipworksauth_jwt_getcertthumbprintsha1(void* lpObj);

char* ipworksauth_jwt_getcertthumbprintsha256(void* lpObj);

char* ipworksauth_jwt_getcertusage(void* lpObj);

int ipworksauth_jwt_getcertusageflags(void* lpObj);

char* ipworksauth_jwt_getcertversion(void* lpObj);

char* ipworksauth_jwt_getcertsubject(void* lpObj);
int ipworksauth_jwt_setcertsubject(void* lpObj, const char* lpszCertSubject);

int ipworksauth_jwt_getcertencoded(void* lpObj, char** lpCertEncoded, int* lenCertEncoded);
int ipworksauth_jwt_setcertencoded(void* lpObj, const char* lpCertEncoded, int lenCertEncoded);

QString GetCertEffectiveDate();

QString GetCertExpirationDate();

QString GetCertExtendedKeyUsage();

QString GetCertFingerprint();

QString GetCertFingerprintSHA1();

QString GetCertFingerprintSHA256();

QString GetCertIssuer();

QString GetCertPrivateKey();

bool GetCertPrivateKeyAvailable();

QString GetCertPrivateKeyContainer();

QString GetCertPublicKey();

QString GetCertPublicKeyAlgorithm();

int GetCertPublicKeyLength();

QString GetCertSerialNumber();

QString GetCertSignatureAlgorithm();

QByteArray GetCertStore();
int SetCertStore(QByteArray qbaCertStore);

QString GetCertStorePassword();
int SetCertStorePassword(QString qsCertStorePassword);

int GetCertStoreType();
int SetCertStoreType(int iCertStoreType);

QString GetCertSubjectAltNames();

QString GetCertThumbprintMD5();

QString GetCertThumbprintSHA1();

QString GetCertThumbprintSHA256();

QString GetCertUsage();

int GetCertUsageFlags();

QString GetCertVersion();

QString GetCertSubject();
int SetCertSubject(QString qsCertSubject);

QByteArray GetCertEncoded();
int SetCertEncoded(QByteArray qbaCertEncoded);

Remarks

This property specifies a certificate with private key.

When calling Sign and SigningAlgorithm is set to an RSA or ECDSA algorithm this property must be set to a certificate with private key.

When calling Decrypt and the message was encrypted using an RSA or ECDH EncryptionAlgorithm this property specifies the certificate with private key used to decrypt the message.

Data Type

IPWorksAuthCertificate

ClaimAudience Property (JWT Class)

The audience claim.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetClaimAudience();
int SetClaimAudience(const char* lpszClaimAudience);

Unicode (Windows)
LPWSTR GetClaimAudience();
INT SetClaimAudience(LPCWSTR lpszClaimAudience);

char* ipworksauth_jwt_getclaimaudience(void* lpObj);
int ipworksauth_jwt_setclaimaudience(void* lpObj, const char* lpszClaimAudience);

QString GetClaimAudience();
int SetClaimAudience(QString qsClaimAudience);

Default Value

""

Remarks

This property holds the audience claim. The audience claim identifies the recipients that the JWT is intended for. The values specified here are case sensitive.

Multiple audience values are supported and should be separated by a semicolon. See AudienceDelimiter for details.

This property corresponds to the aud JSON property.

Data Type

String

ClaimExp Property (JWT Class)

The expiration time claim.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetClaimExp();
int SetClaimExp(const char* lpszClaimExp);

Unicode (Windows)
LPWSTR GetClaimExp();
INT SetClaimExp(LPCWSTR lpszClaimExp);

char* ipworksauth_jwt_getclaimexp(void* lpObj);
int ipworksauth_jwt_setclaimexp(void* lpObj, const char* lpszClaimExp);

QString GetClaimExp();
int SetClaimExp(QString qsClaimExp);

Default Value

""

Remarks

This property holds the expiration time claim. The expiration time claim identifies the expiration time on or after which the JWT must not be accepted. This value corresponds to the exp JSON property.

This value is represented as a numeric value containing the number of seconds since the epoch (January 1st 1970). For instance 1498599163.

Data Type

String

ClaimIssuedAt Property (JWT Class)

The claim indicating the time at which the JWT was issued.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetClaimIssuedAt();
int SetClaimIssuedAt(const char* lpszClaimIssuedAt);

Unicode (Windows)
LPWSTR GetClaimIssuedAt();
INT SetClaimIssuedAt(LPCWSTR lpszClaimIssuedAt);

char* ipworksauth_jwt_getclaimissuedat(void* lpObj);
int ipworksauth_jwt_setclaimissuedat(void* lpObj, const char* lpszClaimIssuedAt);

QString GetClaimIssuedAt();
int SetClaimIssuedAt(QString qsClaimIssuedAt);

Default Value

""

Remarks

This property holds the time at which the JWT was issued. This value corresponds to the iat JSON property.

This value is represented as a numeric value containing the number of seconds since the epoch (January 1st 1970). For instance 1498599163.

Data Type

String

ClaimIssuer Property (JWT Class)

The issuer of the JWT.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetClaimIssuer();
int SetClaimIssuer(const char* lpszClaimIssuer);

Unicode (Windows)
LPWSTR GetClaimIssuer();
INT SetClaimIssuer(LPCWSTR lpszClaimIssuer);

char* ipworksauth_jwt_getclaimissuer(void* lpObj);
int ipworksauth_jwt_setclaimissuer(void* lpObj, const char* lpszClaimIssuer);

QString GetClaimIssuer();
int SetClaimIssuer(QString qsClaimIssuer);

Default Value

""

Remarks

This property holds the issuer of the JWT. The value is a case-sensitive string.

This property corresponds to the iss JSON property.

Data Type

String

ClaimJWTId Property (JWT Class)

The unique identifier for the JWT.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetClaimJWTId();
int SetClaimJWTId(const char* lpszClaimJWTId);

Unicode (Windows)
LPWSTR GetClaimJWTId();
INT SetClaimJWTId(LPCWSTR lpszClaimJWTId);

char* ipworksauth_jwt_getclaimjwtid(void* lpObj);
int ipworksauth_jwt_setclaimjwtid(void* lpObj, const char* lpszClaimJWTId);

QString GetClaimJWTId();
int SetClaimJWTId(QString qsClaimJWTId);

Default Value

""

Remarks

This property holds the unique identifier for the JWT. The value is a case-sensitive string.

This property corresponds to the jti JSON property.

Data Type

String

ClaimNotBefore Property (JWT Class)

The claim identifying the time before which the JWT is invalid.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetClaimNotBefore();
int SetClaimNotBefore(const char* lpszClaimNotBefore);

Unicode (Windows)
LPWSTR GetClaimNotBefore();
INT SetClaimNotBefore(LPCWSTR lpszClaimNotBefore);

char* ipworksauth_jwt_getclaimnotbefore(void* lpObj);
int ipworksauth_jwt_setclaimnotbefore(void* lpObj, const char* lpszClaimNotBefore);

QString GetClaimNotBefore();
int SetClaimNotBefore(QString qsClaimNotBefore);

Default Value

""

Remarks

This property identifies the time before which the JWT is invalid. This value corresponds to the nbf JSON property.

This value is represented as a numeric value containing the number of seconds since the epoch (January 1st 1970). For instance 1498599163.

Data Type

String

Claims Property (JWT Class)

The claims in the JWT.

Syntax

• C++
• C
• Qt

IPWorksAuthList<IPWorksAuthJWTClaim>* GetClaims();
int SetClaims(IPWorksAuthList<IPWorksAuthJWTClaim>* val);

int ipworksauth_jwt_getjwtclaimcount(void* lpObj);
int ipworksauth_jwt_setjwtclaimcount(void* lpObj, int iJWTClaimCount);

int ipworksauth_jwt_getjwtclaimdatatype(void* lpObj, int jwtclaimindex);
int ipworksauth_jwt_setjwtclaimdatatype(void* lpObj, int jwtclaimindex, int iJWTClaimDataType);

char* ipworksauth_jwt_getjwtclaimname(void* lpObj, int jwtclaimindex);
int ipworksauth_jwt_setjwtclaimname(void* lpObj, int jwtclaimindex, const char* lpszJWTClaimName);

char* ipworksauth_jwt_getjwtclaimvalue(void* lpObj, int jwtclaimindex);
int ipworksauth_jwt_setjwtclaimvalue(void* lpObj, int jwtclaimindex, const char* lpszJWTClaimValue);

int GetJWTClaimCount();
int SetJWTClaimCount(int iJWTClaimCount);

int GetJWTClaimDataType(int iJWTClaimIndex);
int SetJWTClaimDataType(int iJWTClaimIndex, int iJWTClaimDataType);

QString GetJWTClaimName(int iJWTClaimIndex);
int SetJWTClaimName(int iJWTClaimIndex, QString qsJWTClaimName);

QString GetJWTClaimValue(int iJWTClaimIndex);
int SetJWTClaimValue(int iJWTClaimIndex, QString qsJWTClaimValue);

Remarks

This property specifies the claims within the JWT. This may be populated before calling Sign or Encrypt. This is populated with the parsed claims after calling Verify, Decrypt, or Parse.

This property is not available at design time.

Data Type

IPWorksAuthJWTClaim

ClaimSubject Property (JWT Class)

The subject identifies the principal of the JWT.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetClaimSubject();
int SetClaimSubject(const char* lpszClaimSubject);

Unicode (Windows)
LPWSTR GetClaimSubject();
INT SetClaimSubject(LPCWSTR lpszClaimSubject);

char* ipworksauth_jwt_getclaimsubject(void* lpObj);
int ipworksauth_jwt_setclaimsubject(void* lpObj, const char* lpszClaimSubject);

QString GetClaimSubject();
int SetClaimSubject(QString qsClaimSubject);

Default Value

""

Remarks

This property holds the subject which identifies the principal of the JWT. The value is a case-sensitive string.

This property corresponds to the sub JSON property.

Data Type

String

ContentEncryptionAlgorithm Property (JWT Class)

The algorithm used to encrypt the content.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetContentEncryptionAlgorithm();
int SetContentEncryptionAlgorithm(int iContentEncryptionAlgorithm);

Unicode (Windows)
INT GetContentEncryptionAlgorithm();
INT SetContentEncryptionAlgorithm(INT iContentEncryptionAlgorithm);

CEA_A128CBC_HS256(0), 
CEA_A192CBC_HS384(1), 
CEA_A256CBC_HS512(2), 
CEA_A128GCM(3), 
CEA_A192GCM(4), 
CEA_A256GCM(5)

int ipworksauth_jwt_getcontentencryptionalgorithm(void* lpObj);
int ipworksauth_jwt_setcontentencryptionalgorithm(void* lpObj, int iContentEncryptionAlgorithm);

int GetContentEncryptionAlgorithm();
int SetContentEncryptionAlgorithm(int iContentEncryptionAlgorithm);

Default Value

0

Remarks

This property specifies the algorithm used to encrypt the content.

The following values are supported.

Data Type

Integer

EncodedJWT Property (JWT Class)

The encoded JWT.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetEncodedJWT();
int SetEncodedJWT(const char* lpszEncodedJWT);

Unicode (Windows)
LPWSTR GetEncodedJWT();
INT SetEncodedJWT(LPCWSTR lpszEncodedJWT);

char* ipworksauth_jwt_getencodedjwt(void* lpObj);
int ipworksauth_jwt_setencodedjwt(void* lpObj, const char* lpszEncodedJWT);

QString GetEncodedJWT();
int SetEncodedJWT(QString qsEncodedJWT);

Default Value

""

Remarks

This property holds the encoded JWT. This is populated after calling Sign or Encrypt.

This must be set to a valid JWT before calling Verify, Decrypt or Parse.

Data Type

String

EncryptionAlgorithm Property (JWT Class)

The key encryption algorithm.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetEncryptionAlgorithm();
int SetEncryptionAlgorithm(int iEncryptionAlgorithm);

Unicode (Windows)
INT GetEncryptionAlgorithm();
INT SetEncryptionAlgorithm(INT iEncryptionAlgorithm);

EA_RSA1_5(0), 
EA_RSA_OAEP(1), 
EA_RSA_OAEP_256(2), 
EA_A128KW(3), 
EA_A192KW(4), 
EA_A256KW(5), 
EA_DIR(6), 
EA_ECDH_ES(7), 
EA_ECDH_ES_A128KW(8), 
EA_ECDH_ES_A192KW(9), 
EA_ECDH_ES_A256KW(10), 
EA_A128GCMKW(11), 
EA_A192GCMKW(12), 
EA_A256GCMKW(13), 
EA_PBES2_HS256_A128KW(14), 
EA_PBES2_HS384_A192KW(15), 
EA_PBES2_HS512_A256KW(16)

int ipworksauth_jwt_getencryptionalgorithm(void* lpObj);
int ipworksauth_jwt_setencryptionalgorithm(void* lpObj, int iEncryptionAlgorithm);

int GetEncryptionAlgorithm();
int SetEncryptionAlgorithm(int iEncryptionAlgorithm);

Default Value

0

Remarks

This property specifies the algorithm used to encrypt the randomly generated content encryption key.

When using an AES algorithm the Key property must be specified. When using an RSA or ECDH algorithm the RecipientCert property must be specified. When using a PBES algorithm the KeyPassword property must be specified;. Possible values are:

When set to an ECDH algorithm the following settings are also applicable:

• PartyUInfo
• PartyVInfo

When set to a PBES algorithm the following settings are also applicable:

• PBES2Count
• PBES2SaltLength

Data Type

Integer

HeaderParams Property (JWT Class)

The JOSE header parameters.

Syntax

• C++
• C
• Qt

IPWorksAuthList<IPWorksAuthHeaderParam>* GetHeaderParams();
int SetHeaderParams(IPWorksAuthList<IPWorksAuthHeaderParam>* val);

int ipworksauth_jwt_getheaderparamcount(void* lpObj);
int ipworksauth_jwt_setheaderparamcount(void* lpObj, int iHeaderParamCount);

int ipworksauth_jwt_getheaderparamdatatype(void* lpObj, int headerparamindex);
int ipworksauth_jwt_setheaderparamdatatype(void* lpObj, int headerparamindex, int iHeaderParamDataType);

char* ipworksauth_jwt_getheaderparamname(void* lpObj, int headerparamindex);
int ipworksauth_jwt_setheaderparamname(void* lpObj, int headerparamindex, const char* lpszHeaderParamName);

char* ipworksauth_jwt_getheaderparamvalue(void* lpObj, int headerparamindex);
int ipworksauth_jwt_setheaderparamvalue(void* lpObj, int headerparamindex, const char* lpszHeaderParamValue);

int GetHeaderParamCount();
int SetHeaderParamCount(int iHeaderParamCount);

int GetHeaderParamDataType(int iHeaderParamIndex);
int SetHeaderParamDataType(int iHeaderParamIndex, int iHeaderParamDataType);

QString GetHeaderParamName(int iHeaderParamIndex);
int SetHeaderParamName(int iHeaderParamIndex, QString qsHeaderParamName);

QString GetHeaderParamValue(int iHeaderParamIndex);
int SetHeaderParamValue(int iHeaderParamIndex, QString qsHeaderParamValue);

Remarks

This property specifies the JOSE header parameters. This may be populated before calling Sign or Encrypt. This is populated with the parsed header values after calling Verify, Decrypt, or Parse.

This property is not available at design time.

Data Type

IPWorksAuthHeaderParam

Key Property (JWT Class)

The key used for HMAC and AES.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetKey(char* &lpKey, int &lenKey);
int SetKey(const char* lpKey, int lenKey);

Unicode (Windows)
INT GetKey(LPSTR &lpKey, INT &lenKey);
INT SetKey(LPCSTR lpKey, INT lenKey);

int ipworksauth_jwt_getkey(void* lpObj, char** lpKey, int* lenKey);
int ipworksauth_jwt_setkey(void* lpObj, const char* lpKey, int lenKey);

QByteArray GetKey();
int SetKey(QByteArray qbaKey);

Default Value

""

Remarks

This property specifies the key used when signing with an HMAC algorithm or encrypting with an AES algorithm.

Signing

This property is applicable when SigningAlgorithm is set to an HMAC algorithm.

It is recommended that the length of the key be equal to or larger than the hash size of the algorithm. Use of keys shorter than the hash size is discouraged.

Sizes (in bytes)

Key Length Details

As mentioned above it is recommended to use a key size equal to the hash size. Use of keys larger than the hash size does not typically significantly increase the function strength. Keys of any length are technically valid however see the below processing rules to understand how keys of varying lengths are treated:

• If the key length is equal to the hash size (recommended) it is used without modification.
• If the key length is less than the hash size it is used without modification.
• If the key length is less than or equal to the block size it is used without modification.
• If the key length is larger than the block size is it first hashed with the same algorithm.

Encrypting

When EncryptionAlgorithm is set to an AES algorithm this property must hold the symmetric key used for encryption and decryption. The size of the key must match the size of the algorithm. For instance when selecting the algorithm A256GCMKW (AES 256) the size of the key must also be 256 bits (32 bytes).

In the case where EncryptionAlgorithm is set to Direct this key is used directly with the algorithm specified by ContentEncryptionAlgorithm and must be an appropriate size for the selected ContentEncryptionAlgorithm.

Data Type

Binary String

KeyId Property (JWT Class)

The Id of the key used to sign or encrypt the message.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetKeyId();
int SetKeyId(const char* lpszKeyId);

Unicode (Windows)
LPWSTR GetKeyId();
INT SetKeyId(LPCWSTR lpszKeyId);

char* ipworksauth_jwt_getkeyid(void* lpObj);
int ipworksauth_jwt_setkeyid(void* lpObj, const char* lpszKeyId);

QString GetKeyId();
int SetKeyId(QString qsKeyId);

Default Value

""

Remarks

This property optionally specifies the Id of the key used to sign the message.

Any string value may be supplied here to help the other party identify the key used to sign or encrypt the message. This may be set before calling the Sign or Encrypt method.

Data Type

String

KeyPassword Property (JWT Class)

The key password used in the PBES algorithm.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetKeyPassword();
int SetKeyPassword(const char* lpszKeyPassword);

Unicode (Windows)
LPWSTR GetKeyPassword();
INT SetKeyPassword(LPCWSTR lpszKeyPassword);

char* ipworksauth_jwt_getkeypassword(void* lpObj);
int ipworksauth_jwt_setkeypassword(void* lpObj, const char* lpszKeyPassword);

QString GetKeyPassword();
int SetKeyPassword(QString qsKeyPassword);

Default Value

""

Remarks

This property specifies the key password used to derive a key when using a PBES EncryptionAlgorithm.

This is only applicable to PBES algorithms and must be set before calling Encrypt or Decrypt.

This property does not apply when calling Sign or Verify.

Data Type

String

RecipientCert Property (JWT Class)

The certificate used for encryption.

Syntax

• C++
• C
• Qt

IPWorksAuthCertificate* GetRecipientCert();
int SetRecipientCert(IPWorksAuthCertificate* val);

char* ipworksauth_jwt_getrecipientcerteffectivedate(void* lpObj);

char* ipworksauth_jwt_getrecipientcertexpirationdate(void* lpObj);

char* ipworksauth_jwt_getrecipientcertextendedkeyusage(void* lpObj);

char* ipworksauth_jwt_getrecipientcertfingerprint(void* lpObj);

char* ipworksauth_jwt_getrecipientcertfingerprintsha1(void* lpObj);

char* ipworksauth_jwt_getrecipientcertfingerprintsha256(void* lpObj);

char* ipworksauth_jwt_getrecipientcertissuer(void* lpObj);

char* ipworksauth_jwt_getrecipientcertprivatekey(void* lpObj);

int ipworksauth_jwt_getrecipientcertprivatekeyavailable(void* lpObj);

char* ipworksauth_jwt_getrecipientcertprivatekeycontainer(void* lpObj);

char* ipworksauth_jwt_getrecipientcertpublickey(void* lpObj);

char* ipworksauth_jwt_getrecipientcertpublickeyalgorithm(void* lpObj);

int ipworksauth_jwt_getrecipientcertpublickeylength(void* lpObj);

char* ipworksauth_jwt_getrecipientcertserialnumber(void* lpObj);

char* ipworksauth_jwt_getrecipientcertsignaturealgorithm(void* lpObj);

int ipworksauth_jwt_getrecipientcertstore(void* lpObj, char** lpRecipientCertStore, int* lenRecipientCertStore);
int ipworksauth_jwt_setrecipientcertstore(void* lpObj, const char* lpRecipientCertStore, int lenRecipientCertStore);

char* ipworksauth_jwt_getrecipientcertstorepassword(void* lpObj);
int ipworksauth_jwt_setrecipientcertstorepassword(void* lpObj, const char* lpszRecipientCertStorePassword);

int ipworksauth_jwt_getrecipientcertstoretype(void* lpObj);
int ipworksauth_jwt_setrecipientcertstoretype(void* lpObj, int iRecipientCertStoreType);

char* ipworksauth_jwt_getrecipientcertsubjectaltnames(void* lpObj);

char* ipworksauth_jwt_getrecipientcertthumbprintmd5(void* lpObj);

char* ipworksauth_jwt_getrecipientcertthumbprintsha1(void* lpObj);

char* ipworksauth_jwt_getrecipientcertthumbprintsha256(void* lpObj);

char* ipworksauth_jwt_getrecipientcertusage(void* lpObj);

int ipworksauth_jwt_getrecipientcertusageflags(void* lpObj);

char* ipworksauth_jwt_getrecipientcertversion(void* lpObj);

char* ipworksauth_jwt_getrecipientcertsubject(void* lpObj);
int ipworksauth_jwt_setrecipientcertsubject(void* lpObj, const char* lpszRecipientCertSubject);

int ipworksauth_jwt_getrecipientcertencoded(void* lpObj, char** lpRecipientCertEncoded, int* lenRecipientCertEncoded);
int ipworksauth_jwt_setrecipientcertencoded(void* lpObj, const char* lpRecipientCertEncoded, int lenRecipientCertEncoded);

QString GetRecipientCertEffectiveDate();

QString GetRecipientCertExpirationDate();

QString GetRecipientCertExtendedKeyUsage();

QString GetRecipientCertFingerprint();

QString GetRecipientCertFingerprintSHA1();

QString GetRecipientCertFingerprintSHA256();

QString GetRecipientCertIssuer();

QString GetRecipientCertPrivateKey();

bool GetRecipientCertPrivateKeyAvailable();

QString GetRecipientCertPrivateKeyContainer();

QString GetRecipientCertPublicKey();

QString GetRecipientCertPublicKeyAlgorithm();

int GetRecipientCertPublicKeyLength();

QString GetRecipientCertSerialNumber();

QString GetRecipientCertSignatureAlgorithm();

QByteArray GetRecipientCertStore();
int SetRecipientCertStore(QByteArray qbaRecipientCertStore);

QString GetRecipientCertStorePassword();
int SetRecipientCertStorePassword(QString qsRecipientCertStorePassword);

int GetRecipientCertStoreType();
int SetRecipientCertStoreType(int iRecipientCertStoreType);

QString GetRecipientCertSubjectAltNames();

QString GetRecipientCertThumbprintMD5();

QString GetRecipientCertThumbprintSHA1();

QString GetRecipientCertThumbprintSHA256();

QString GetRecipientCertUsage();

int GetRecipientCertUsageFlags();

QString GetRecipientCertVersion();

QString GetRecipientCertSubject();
int SetRecipientCertSubject(QString qsRecipientCertSubject);

QByteArray GetRecipientCertEncoded();
int SetRecipientCertEncoded(QByteArray qbaRecipientCertEncoded);

Remarks

When calling Encrypt and EncryptionAlgorithm is set to an RSA or ECDH algorithm this property must be set to a public certificate of the recipient.

Data Type

IPWorksAuthCertificate

SignerCert Property (JWT Class)

The certificate used for signature verification.

Syntax

• C++
• C
• Qt

IPWorksAuthCertificate* GetSignerCert();
int SetSignerCert(IPWorksAuthCertificate* val);

char* ipworksauth_jwt_getsignercerteffectivedate(void* lpObj);

char* ipworksauth_jwt_getsignercertexpirationdate(void* lpObj);

char* ipworksauth_jwt_getsignercertextendedkeyusage(void* lpObj);

char* ipworksauth_jwt_getsignercertfingerprint(void* lpObj);

char* ipworksauth_jwt_getsignercertfingerprintsha1(void* lpObj);

char* ipworksauth_jwt_getsignercertfingerprintsha256(void* lpObj);

char* ipworksauth_jwt_getsignercertissuer(void* lpObj);

char* ipworksauth_jwt_getsignercertprivatekey(void* lpObj);

int ipworksauth_jwt_getsignercertprivatekeyavailable(void* lpObj);

char* ipworksauth_jwt_getsignercertprivatekeycontainer(void* lpObj);

char* ipworksauth_jwt_getsignercertpublickey(void* lpObj);

char* ipworksauth_jwt_getsignercertpublickeyalgorithm(void* lpObj);

int ipworksauth_jwt_getsignercertpublickeylength(void* lpObj);

char* ipworksauth_jwt_getsignercertserialnumber(void* lpObj);

char* ipworksauth_jwt_getsignercertsignaturealgorithm(void* lpObj);

int ipworksauth_jwt_getsignercertstore(void* lpObj, char** lpSignerCertStore, int* lenSignerCertStore);
int ipworksauth_jwt_setsignercertstore(void* lpObj, const char* lpSignerCertStore, int lenSignerCertStore);

char* ipworksauth_jwt_getsignercertstorepassword(void* lpObj);
int ipworksauth_jwt_setsignercertstorepassword(void* lpObj, const char* lpszSignerCertStorePassword);

int ipworksauth_jwt_getsignercertstoretype(void* lpObj);
int ipworksauth_jwt_setsignercertstoretype(void* lpObj, int iSignerCertStoreType);

char* ipworksauth_jwt_getsignercertsubjectaltnames(void* lpObj);

char* ipworksauth_jwt_getsignercertthumbprintmd5(void* lpObj);

char* ipworksauth_jwt_getsignercertthumbprintsha1(void* lpObj);

char* ipworksauth_jwt_getsignercertthumbprintsha256(void* lpObj);

char* ipworksauth_jwt_getsignercertusage(void* lpObj);

int ipworksauth_jwt_getsignercertusageflags(void* lpObj);

char* ipworksauth_jwt_getsignercertversion(void* lpObj);

char* ipworksauth_jwt_getsignercertsubject(void* lpObj);
int ipworksauth_jwt_setsignercertsubject(void* lpObj, const char* lpszSignerCertSubject);

int ipworksauth_jwt_getsignercertencoded(void* lpObj, char** lpSignerCertEncoded, int* lenSignerCertEncoded);
int ipworksauth_jwt_setsignercertencoded(void* lpObj, const char* lpSignerCertEncoded, int lenSignerCertEncoded);

QString GetSignerCertEffectiveDate();

QString GetSignerCertExpirationDate();

QString GetSignerCertExtendedKeyUsage();

QString GetSignerCertFingerprint();

QString GetSignerCertFingerprintSHA1();

QString GetSignerCertFingerprintSHA256();

QString GetSignerCertIssuer();

QString GetSignerCertPrivateKey();

bool GetSignerCertPrivateKeyAvailable();

QString GetSignerCertPrivateKeyContainer();

QString GetSignerCertPublicKey();

QString GetSignerCertPublicKeyAlgorithm();

int GetSignerCertPublicKeyLength();

QString GetSignerCertSerialNumber();

QString GetSignerCertSignatureAlgorithm();

QByteArray GetSignerCertStore();
int SetSignerCertStore(QByteArray qbaSignerCertStore);

QString GetSignerCertStorePassword();
int SetSignerCertStorePassword(QString qsSignerCertStorePassword);

int GetSignerCertStoreType();
int SetSignerCertStoreType(int iSignerCertStoreType);

QString GetSignerCertSubjectAltNames();

QString GetSignerCertThumbprintMD5();

QString GetSignerCertThumbprintSHA1();

QString GetSignerCertThumbprintSHA256();

QString GetSignerCertUsage();

int GetSignerCertUsageFlags();

QString GetSignerCertVersion();

QString GetSignerCertSubject();
int SetSignerCertSubject(QString qsSignerCertSubject);

QByteArray GetSignerCertEncoded();
int SetSignerCertEncoded(QByteArray qbaSignerCertEncoded);

Remarks

When calling Verify and the algorithm used is RSA or ECDSA this property must be set to the public certificate of the signer.

Data Type

IPWorksAuthCertificate

SigningAlgorithm Property (JWT Class)

The algorithm used when signing.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetSigningAlgorithm();
int SetSigningAlgorithm(int iSigningAlgorithm);

Unicode (Windows)
INT GetSigningAlgorithm();
INT SetSigningAlgorithm(INT iSigningAlgorithm);

SA_HS256(0), 
SA_HS384(1), 
SA_HS512(2), 
SA_RS256(3), 
SA_RS384(4), 
SA_RS512(5), 
SA_ES256(6), 
SA_ES384(7), 
SA_ES512(8), 
SA_PS256(9), 
SA_PS384(10), 
SA_PS512(11), 
SA_ES256K(12), 
SA_NONE(99)

int ipworksauth_jwt_getsigningalgorithm(void* lpObj);
int ipworksauth_jwt_setsigningalgorithm(void* lpObj, int iSigningAlgorithm);

int GetSigningAlgorithm();
int SetSigningAlgorithm(int iSigningAlgorithm);

Default Value

0

Remarks

This property specifies the algorithm to use when signing.

When signing with an HMAC algorithm Key must be specified. When an RSA or ECDSA algorithm is selected Certificate must be set before calling Sign and SignerCert must be set before calling Verify. The following values are supported:

Note: This setting is also applicable when StrictValidation is enabled before calling Verify.

Data Type

Integer

AddClaim Method (JWT Class)

Adds an new claim.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int AddClaim(const char* lpszname, const char* lpszvalue, int idataType);

Unicode (Windows)
INT AddClaim(LPCWSTR lpszname, LPCWSTR lpszvalue, INT idataType);

int ipworksauth_jwt_addclaim(void* lpObj, const char* lpszname, const char* lpszvalue, int idataType);

int AddClaim(const QString& qsname, const QString& qsvalue, int idataType);

Remarks

This method adds a claim to the existing claims. Use this method to add claims that are not already supported directly via properties.

The Name parameter defines the name of the claim. The Value parameter is the value, represented as a string. The JSON data type of the value is defined by the DataType parameter. Possible DataType values are:

• 0 (Object)
• 1 (Array)
• 2 (String)
• 3 (Number)
• 4 (Bool)
• 5 (Null)

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

AddHeaderParam Method (JWT Class)

Adds additional header parameters.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int AddHeaderParam(const char* lpszname, const char* lpszvalue, int idataType);

Unicode (Windows)
INT AddHeaderParam(LPCWSTR lpszname, LPCWSTR lpszvalue, INT idataType);

int ipworksauth_jwt_addheaderparam(void* lpObj, const char* lpszname, const char* lpszvalue, int idataType);

int AddHeaderParam(const QString& qsname, const QString& qsvalue, int idataType);

Remarks

This method is used to add additional header parameters before calling Encrypt or Sign.

The Name and Value parameters define the name and value of the parameter respectively. The DataType parameter specifies the JSON data type of the value. Possible values for DataType are:

• 0 (Object)
• 1 (Array)
• 2 (String)
• 3 (Number)
• 4 (Bool)
• 5 (Null)

Signing

To add additional parameters to the JOSE header use this method. For instance to create this header:

{
	"alg": "HS256",
	"crit": [
		"myheader"
	],
	"myheader": "testvalue"
}

The following code can be used:

byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; //Sign the payload using HS256 Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saHS256; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.AddHeaderParam("crit", "[\"myheader\"]", 1); jwt.AddHeaderParam("myheader", "testvalue", 2); jwt.KeyB = key; jwt.Sign(); string signedData = jwt.EncodedJWT;

Note: when calling Sign the class will automatically add some headers based on properties that are set.

Parameters Automatically Set:

Encrypting

To add additional parameters to the JOSE header use this method. For instance to create this header:

{
	"alg": "A256GCMKW",
	"enc": "A128CBC-HS256",
	"iv": "cPTXlBL7aMiv-Dnf",
	"tag": "r5tmS-tXmfFngrybpnnt5g",
	"crit": [
		"myheader"
	],
	"myheader": "testvalue"
}

The following code can be used:

byte[] key = new byte[] { 164, 60, 194, 0, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.AddHeaderParam("crit", "[\"myheader\"]",1); jwt.AddHeaderParam("myheader", "testvalue",2); jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaA256GCMKW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Note: When calling Encrypt the class will automatically add headers based on the selected EncryptionAlgorithm and other properties that may be set.

Parameters Automatically Set:

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Config Method (JWT Class)

Sets or retrieves a configuration setting.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* Config(const char* lpszConfigurationString);

Unicode (Windows)
LPWSTR Config(LPCWSTR lpszConfigurationString);

char* ipworksauth_jwt_config(void* lpObj, const char* lpszConfigurationString);

QString Config(const QString& qsConfigurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

Error Handling (C++)

This method returns a String value; after it returns, call the GetLastErrorCode() method to obtain its result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.

Decrypt Method (JWT Class)

Decrypts the encoded JWT.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Decrypt();

Unicode (Windows)
INT Decrypt();

int ipworksauth_jwt_decrypt(void* lpObj);

int Decrypt();

Remarks

This method decrypts the encoded JWT.

Before calling the Decrypt method set EncodedJWT to a valid compact serialized JWT string. For instance:

eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.4tcAnZJ00u4GY2kLOanPOL4CtvcfraZ8SIi6bOZ27qYBI2rHITPc1Q.c_9rCTdPn-saLCti2ZEyWQ.eLwqqo5BGNa70RlsvT-vTh7Gk0hjpJYY_9Zc39Vim_qEtjyMcxZygBpkfx9brzQr9rUbuiAhoCMXKip2-lKT6w.NkuLDPmWxWL4BaTWHWicIQ

The type and format of the private key depends on the algorithm used to encrypt the data. The following table summarizes the relationship:

If this method returns without error decryption was successful. If decryption fails then this method fails with an error. After calling this method the payload will be present in the Claim* properties and the HeaderParams property will contain the headers. Headers of the parsed message are also available through the HeaderParam event.

The following properties are applicable when calling this method:

• Certificate (conditional - required for RSA and ECDH)
• EncodedJWT
• Key (conditional - required for AES)
• ContentEncryptionAlgorithm (only if StrictValidation is True)
• EncryptionAlgorithm (only if StrictValidation is True)
• HeaderParams
• StrictValidation

After calling this method the following properties are populated:

• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• ClaimSubject
• HeaderParams

Notes for AES Algorithms (A128KW, A192KW, A256KW, A128GCMKW, A192GCMKW, A256GCMKW)

To decrypt messages that use AES encryption Key must be set to a key of appropriate length for the algorithm. For instance a 256 bit key would be used for A256KW.

The key must be known by both parties in order for encryption and decryption to take place.

byte[] key = new byte[] { 164, 60, 194, 0, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for RSA Algorithms (RSA1_5, RSA-OEAP, RSA-OAEP-256)

The RSA based algorithms use asymmetric encryption. Encrypting is done with a public key and decryption is done with a private key. The certificate with private key must be specified. For instance:

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPFXFile, "..\\jwt.pfx", "password", "*"); jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for ECDH Algorithms (ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW)

ECDH algorithms require a valid ECC private key to decrypt the message. If the key was originally created with the ECC class the PEM encoded PrivateKey may be used directly with the Certificate property.

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPEMKeyFile, privKeyFile, "", "*"); jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

To use an ECC private key created by other means the ECC class may be used to import the key parameters. Populate the Rx, Ry, and KB properties of the ECC component first to obtain the PEM formatted public key. For instance:

nsoftware.IPWorksEncrypt.Ecc ecc = new nsoftware.IPWorksEncrypt.Ecc(); byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; byte[] k_bytes = new byte[] { 81, 65, 201, 24, 235, 249, 162, 148, 169, 150, 109, 181, 61, 238, 145, 122, 31, 30, 151, 94, 239, 90, 222, 217, 63, 103, 54, 2, 176, 232, 248, 168 }; ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; ecc.Key.KB = k_bytes; string privKey = ecc.Key.PrivateKey; Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPEMKeyBlob, privKey, "", "*"); jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for PBES Algorithms (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW

PBES algorithms derive a content encryption key from the KeyPassword property. Set KeyPassword to the shared secret.

Jwt jwt = new Jwt(); jwt.KeyPassword = "secret"; jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Notes for Direct Shared Keys

When Direct encryption is used the Key property must be set to a valid symmetric key that will be used directly by the ContentEncryptionAlgorithm. For instance:

byte[] key = new byte[] { 164, 60, 194, 0, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.EncodedJWT = encryptedData; jwt.Decrypt(); string issuer = jwt.ClaimIssuer;

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Encrypt Method (JWT Class)

Encrypts the claims with the specified algorithms.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Encrypt();

Unicode (Windows)
INT Encrypt();

int ipworksauth_jwt_encrypt(void* lpObj);

int Encrypt();

Remarks

This method encrypts the claims using the specified algorithms.

To create an encrypted JWT JSON Web Encryption (JWE) is performed by first generating a random key used to encrypt the content. The content encryption key is used to encrypt the content using the algorithm specified by ContentEncryptionAlgorithm. The content encryption key is then encrypted itself using the algorithm specified by EncryptionAlgorithm. The content encryption key is not directly exposed in the API as it is randomly generated.

After calling this method the compact serialized JWT is written to EncodedJWT. For instance:

eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.4tcAnZJ00u4GY2kLOanPOL4CtvcfraZ8SIi6bOZ27qYBI2rHITPc1Q.c_9rCTdPn-saLCti2ZEyWQ.eLwqqo5BGNa70RlsvT-vTh7Gk0hjpJYY_9Zc39Vim_qEtjyMcxZygBpkfx9brzQr9rUbuiAhoCMXKip2-lKT6w.NkuLDPmWxWL4BaTWHWicIQ

The class will use the values present in the Claim* properties to build the encoded JWT. After calling this method the EncodedJWT property will hold the compact serialized JWT. The following properties are applicable when calling this method:

• EncryptionAlgorithm (required)
• Key (conditional - required for AES)
• KeyPassword (conditional - required for PBES)
• RecipientCert (conditional - required for ECDH and RSA)
• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• CompressionAlgorithm
• ContentEncryptionAlgorithm
• HeaderParams
• KeyId

Notes for AES Algorithms (A128KW, A192KW, A256KW, A128GCMKW, A192GCMKW, A256GCMKW)

When EncryptionAlgorithm is set to a AES algorithm Key must be set to a key of appropriate length for the algorithm. For instance a 256 bit key would be used for A256KW.

To use an existing AES key provide the bytes to the Key property. For instance:

byte[] key = new byte[] { 164, 60, 194, 0, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; //Encrypt the payload using A256KW Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaA256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for RSA Algorithms (RSA1_5, RSA-OEAP, RSA-OAEP-256)

The RSA based algorithms use asymmetric encryption. Encrypting is done with a public key and decryption is done with a private key. The public certificate should be in PEM (base64) format. For instance:

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate("..\\recipient.cer"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaRSA_OAEP; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for ECDH Algorithms (ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW)

ECDH algorithms require a valid ECC public key to encrypt the message. If the key was originally created with the ECC class the PEM encoded PublicKey may be used directly with the Certificate property. An example PEM encoded public certificate created by the ECC component:

-----BEGIN PUBLIC KEY-----
MIIBMjCB7AYHKoZIzj0CATCB4AIBATAsBgcqhkjOPQEBAiEA/////wAAAAEAAAAAAAAAAAAA
AAD///////////////8wRAQg/////wAAAAEAAAAAAAAAAAAAAAD///////////////wEIFrG
NdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n0mBLBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt
6zOg9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA
//////////+85vqtpxeehPO5ysL8YyVRAgEBA0EEIC5rbLp11Mnz6cBXLLriaDIov3rm8RAY
x/OR0bOKiff0cQy+sLVaxjseqFk/+Xvl4ORSv5Z6HdHv5GyEpA0UoA==
-----END PUBLIC KEY-----

Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKeyFile, "", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaECDH_ES_A256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

To use an ECC public key created by other means the ECC class may be used to import the key parameters. Populate the Rx and Ry properties of the ECC component first to obtain the PEM formatted public key. For instance:

byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; nsoftware.IPWorksEncrypt.Ecc ecc = new nsoftware.IPWorksEncrypt.Ecc(); ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; string pubKey = ecc.Key.PublicKey; Jwt jwt = new Jwt(); jwt.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaECDH_ES_A256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for PBES Algorithms (PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW

PBES algorithms derive a content encryption key from the KeyPassword property. Set KeyPassword to a shared secret.

Jwt jwt = new Jwt(); jwt.KeyPassword = "secret"; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaPBES2_HS512_A256KW; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Notes for Direct Shared Keys

When EncryptionAlgorithm is set to Direct the Key property must be set to a valid symmetric key that will be used directly by the ContentEncryptionAlgorithm. In this case a content encryption key is not generated randomly, the Key is used instead. The length of the specified Key must be valid for the selected ContentEncryptionAlgorithm. For instance:

byte[] key = new byte[] { 164, 62, 191, 60, 161, 189, 41, 38, 130, 89, 141, 164, 45, 170, 159, 209, 69, 137, 243, 216, 191, 131, 47, 250, 32, 107, 231, 117, 37, 158, 225, 234 }; Jwt jwt = new Jwt(); jwt.EncryptionAlgorithm = JwtEncryptionAlgorithms.eaDir; jwt.ContentEncryptionAlgorithm = JwtContentEncryptionAlgorithms.ceaA256GCM; jwt.KeyB = key; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Encrypt(); string encryptedData = jwt.EncodedJWT;

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Parse Method (JWT Class)

Parses the encoded JWT.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Parse();

Unicode (Windows)
INT Parse();

int ipworksauth_jwt_parse(void* lpObj);

int Parse();

Remarks

This method parses, but does not verify the encoded JWT.

Take care when using this method as no verification or decryption is performed. This method may be helpful in cases where only header information is desired.

If verification or decryption is desired, use Verify or Decrypt instead. It is not necessary to call this method before calling Verify or Decrypt. Verify or Decrypt will both parse and decrypt the message.

When calling this method the headers are parsed. The HeaderParam and RecipientInfo events will fire and the HeaderParams property will be populated.

If the message is signed (not encrypted) the claims will also be parsed and the Claim* properties will be populated.

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Reset Method (JWT Class)

Resets the class properties.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Reset();

Unicode (Windows)
INT Reset();

int ipworksauth_jwt_reset(void* lpObj);

int Reset();

Remarks

This method resets all message and key properties to their default values.

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Sign Method (JWT Class)

Signs the payload with the specified algorithm.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Sign();

Unicode (Windows)
INT Sign();

int ipworksauth_jwt_sign(void* lpObj);

int Sign();

Remarks

This method signs the claims specified by the Claim* properties with the specified SigningAlgorithm.

Before calling the Sign method set SigningAlgorithm to the algorithm which will be used to sign the message. The result of signing is a compact serialized JWT string. For instance:

eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOlsiYXVkaWVuY2UiXSwiaXNzIjoiaXNzdWVyIn0.mlFETSma4WUcUSjNSUWA1n9QBcQHCkHN-y4zeBsCVqI

The class will use the values present in the Claim* properties to build the encoded JWT. After calling this method the EncodedJWT property will hold the compact serialized JWT. The following properties are applicable when calling this method:

• SigningAlgorithm (required)
• Certificate (conditional - required for ECDSA and RSA)
• Key (conditional - required for HMAC)
• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• HeaderParams
• KeyId

Notes for HMAC Algorithms (HS256, HS384, HS512)

When SigningAlgorithm is set to a HMAC algorithm Key must be set to a key of appropriate length for the algorithm. The Key should be the same number of bits as the algorithm being used. For instance a 256 bit key would be used for HS256.

The key must be known by both parties in order for signing and verification to take place. To use an existing HMAC key provide the bytes to the Key property. For instance:

//HMAC SHA-256 Key byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; //Sign the payload using HS256 Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saHS256; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.KeyB = key; jwt.Sign(); string signedData = jwt.EncodedJWT;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The private key may be in PFX or PEM format.

Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saRS256; jwt.Certificate = new Certificate(CertStoreTypes.cstPFXFile, "..\\jwt.pfx", "test", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Sign(); string signedMessage = jwt.EncodedJWT;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC private key in order to sign data. The Certificate property should be set to a certificate with an ECC key. The CertMgr class can be used to create a certificate with an ECC key.

//Create an ECC key with SHA-256 Certmgr mgr = new Certmgr(); mgr.Config("CertPublicKeyAlgorithm=ECDSA_P256"); mgr.CertStoreType = CertStoreTypes.cstPEMKeyFile; mgr.CertStore = "C:\\temp\\ecdsa.pem"; mgr.CreateCertificate("CN=ecdsa", 123); //Sign the payload using ES256 Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saES256; jwt.Certificate = new Certificate(CertStoreTypes.cstPEMKeyFile, "C:\\temp\\ecdsa.pem", "", "*"); jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Sign(); string signedMessage = jwt.EncodedJWT;

Notes for Unsecured (none)

To create a JWS token without any security set SigningAlgorithm to jwtNone.

Jwt jwt = new Jwt(); jwt.SigningAlgorithm = JwtSigningAlgorithms.saNone; jwt.ClaimAudience = "audience"; jwt.ClaimIssuer = "issuer"; jwt.ClaimExp = "1498508071"; jwt.Sign(); string unsecuredMessage = jwt.EncodedJWT;

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Verify Method (JWT Class)

Verifies the signature of the encoded JWT.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Verify();

Unicode (Windows)
INT Verify();

int ipworksauth_jwt_verify(void* lpObj);

int Verify();

Remarks

This method verifies the signature of the encoded JWT.

Before calling the Verify method set EncodedJWT to a valid compact serialized JWT. For instance:

eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOlsiYXVkaWVuY2UiXSwiaXNzIjoiaXNzdWVyIn0.mlFETSma4WUcUSjNSUWA1n9QBcQHCkHN-y4zeBsCVqI

The Key or SignerCert properties should be set to the HMAC key or public certificate respectively. If the correct Key or SignerCert is not known ahead of time the KeyId parameter of the SignerInfo event may be used to identify the correct key.

If this method returns without error verification was successful. If verification fails then this method fails with an error. After calling this method the claims will be parsed and the Claim* properties will be populated. The the HeaderParams property will contain the headers. Headers of the parsed message are also available through the HeaderParam event.

The following properties are applicable when calling this method:

• EncodedJWT (required)
• Key (conditional - required for HMAC)
• SignerCert (conditional - required for ECDSA and RSA)
• SigningAlgorithm (only if StrictValidation is True)
• StrictValidation
• ExpectedAudience (optional)
• ExpectedExp (optional)
• ExpectedIssuedAt (optional)
• ExpectedIssuer (optional)
• ExpectedJWTId (optional)
• ExpectedNotBefore (optional)
• ExpectedSubject (optional)

After calling this method the following properties are populated:

• ClaimAudience
• ClaimExp
• ClaimIssuedAt
• ClaimIssuer
• ClaimJWTId
• ClaimNotBefore
• ClaimSubject
• HeaderParams

Notes for HMAC Algorithms (HS256, HS384, HS512)

When verifying a message originally signed with a HMAC algorithm Key must be set to the same key used during signing. The key must be known by both parties in order for signing and verification to take place.

byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; Jwt jwt = new Jwt(); jwt.KeyB = key; jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The public key is typically in PEM format.

Jwt jwt = new Jwt(); jwt.SignerCert = new Certificate("..\\jwt.cer"); jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC public key to verify the message. The PEM encoded public key may be used directly with the Certificate property. An example PEM encoded public certificate created by the CertMgr class:

-----BEGIN CERTIFICATE-----
MIIBETCBtaADAgECAgF7MAwGCCqGSM49BAMCBQAwEDEOMAwGA1UEAxMFZWNkc2EwHhcNMjMw
NzAzMTcwMjU3WhcNMjQwNzAyMTcwMjU3WjAQMQ4wDAYDVQQDEwVlY2RzYTBZMBMGByqGSM49
AgEGCCqGSM49AwEHA0IABGJv251JI7ITcq+fac9Z2yYkhTLSRhWGzBw1wEJZbs/8AZbVmvcy
4BzKSZEaTfBsCHIt3FLNgRLdugI+B65eQDYwDAYIKoZIzj0EAwIFAANJADBGAiEAzmH5LKKn
r4iy9kJvIlCslpcBHM/8k0XQaj13Zwhm2ocCIQD/cSiC4EuqRkxT4IKET7ko3iI5YUS+J5W5
/0xnxxxIpQ==
-----END CERTIFICATE-----

Jwt jwt = new Jwt(); jwt.SignerCert = new Certificate(CertStoreTypes.cstPublicKeyBlob, pubKey, "", "*"); jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Notes for Unsecured (none)

To parse a JWS token without any security call the Sign method without setting the Key or Certificate properties.

Jwt jwt = new Jwt(); jwt.EncodedJWT = signedData; jwt.Verify(); string issuer = jwt.ClaimIssuer;

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

ClaimInfo Event (JWT Class)

Fires once for each claim.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FireClaimInfo(JWTClaimInfoEventParams *e);

typedef struct {
  const char *Name;
  const char *Value;
  int DataType;
  int reserved;
} JWTClaimInfoEventParams;


Unicode (Windows)
virtual INT FireClaimInfo(JWTClaimInfoEventParams *e);

typedef struct {
  LPCWSTR Name;
  LPCWSTR Value;
  INT DataType;
  INT reserved;
} JWTClaimInfoEventParams;

#define EID_JWT_CLAIMINFO 1

virtual INT IPWORKSAUTH_CALL FireClaimInfo(LPSTR &lpszName, LPSTR &lpszValue, INT &iDataType);

class JWTClaimInfoEventParams {
public:
  const QString &Name();

  const QString &Value();

  int DataType();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void ClaimInfo(JWTClaimInfoEventParams *e);

// Or, subclass JWT and override this emitter function.
virtual int FireClaimInfo(JWTClaimInfoEventParams *e) {...}

Remarks

When Decrypt, Verify or Parse is called this event will fire once for each claim in the JWT.

Name is the name of the claim.

Value is the value of the claim.

DataType specifies the JSON data type of the value. Possible values are:

• 0 (Object)
• 1 (Array)
• 2 (String)
• 3 (Number)
• 4 (Bool)
• 5 (Null)

Error Event (JWT Class)

Fired when information is available about errors during data delivery.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FireError(JWTErrorEventParams *e);

typedef struct {
  int ErrorCode;
  const char *Description;
  int reserved;
} JWTErrorEventParams;


Unicode (Windows)
virtual INT FireError(JWTErrorEventParams *e);

typedef struct {
  INT ErrorCode;
  LPCWSTR Description;
  INT reserved;
} JWTErrorEventParams;

#define EID_JWT_ERROR 2

virtual INT IPWORKSAUTH_CALL FireError(INT &iErrorCode, LPSTR &lpszDescription);

class JWTErrorEventParams {
public:
  int ErrorCode();

  const QString &Description();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void Error(JWTErrorEventParams *e);

// Or, subclass JWT and override this emitter function.
virtual int FireError(JWTErrorEventParams *e) {...}

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the class fails with an error.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

HeaderParam Event (JWT Class)

Fires once for each JOSE header parameter.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FireHeaderParam(JWTHeaderParamEventParams *e);

typedef struct {
  const char *Name;
  const char *Value;
  int DataType;
  int reserved;
} JWTHeaderParamEventParams;


Unicode (Windows)
virtual INT FireHeaderParam(JWTHeaderParamEventParams *e);

typedef struct {
  LPCWSTR Name;
  LPCWSTR Value;
  INT DataType;
  INT reserved;
} JWTHeaderParamEventParams;

#define EID_JWT_HEADERPARAM 3

virtual INT IPWORKSAUTH_CALL FireHeaderParam(LPSTR &lpszName, LPSTR &lpszValue, INT &iDataType);

class JWTHeaderParamEventParams {
public:
  const QString &Name();

  const QString &Value();

  int DataType();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void HeaderParam(JWTHeaderParamEventParams *e);

// Or, subclass JWT and override this emitter function.
virtual int FireHeaderParam(JWTHeaderParamEventParams *e) {...}

Remarks

When Decrypt, Verify or Parse is called this event will fire once for each JOSE header parameter.

Name is the name of the parameter.

Value is the value of the parameter.

DataType specifies the JSON data type of the value. Possible values are:

• 0 (Object)
• 1 (Array)
• 2 (String)
• 3 (Number)
• 4 (Bool)
• 5 (Null)

RecipientInfo Event (JWT Class)

Fired with information about the recipient key of the encrypted message.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FireRecipientInfo(JWTRecipientInfoEventParams *e);

typedef struct {
  const char *KeyId;
  const char *Algorithm;
  int reserved;
} JWTRecipientInfoEventParams;


Unicode (Windows)
virtual INT FireRecipientInfo(JWTRecipientInfoEventParams *e);

typedef struct {
  LPCWSTR KeyId;
  LPCWSTR Algorithm;
  INT reserved;
} JWTRecipientInfoEventParams;

#define EID_JWT_RECIPIENTINFO 4

virtual INT IPWORKSAUTH_CALL FireRecipientInfo(LPSTR &lpszKeyId, LPSTR &lpszAlgorithm);

class JWTRecipientInfoEventParams {
public:
  const QString &KeyId();

  const QString &Algorithm();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void RecipientInfo(JWTRecipientInfoEventParams *e);

// Or, subclass JWT and override this emitter function.
virtual int FireRecipientInfo(JWTRecipientInfoEventParams *e) {...}

Remarks

This event fires with information about the key used to encrypt the data. This may be used to help identify the Key or Certificate properties to load in order to decrypt the message. This event fires when Decrypt or Parse is called.

KeyId is the Id of the key as supplied by the entity that created the message. This may be empty.

Algorithm is the encryption algorithm used to encrypt the data.

SignerInfo Event (JWT Class)

Fires with information about the signature.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FireSignerInfo(JWTSignerInfoEventParams *e);

typedef struct {
  const char *KeyId;
  const char *Algorithm;
  int reserved;
} JWTSignerInfoEventParams;


Unicode (Windows)
virtual INT FireSignerInfo(JWTSignerInfoEventParams *e);

typedef struct {
  LPCWSTR KeyId;
  LPCWSTR Algorithm;
  INT reserved;
} JWTSignerInfoEventParams;

#define EID_JWT_SIGNERINFO 5

virtual INT IPWORKSAUTH_CALL FireSignerInfo(LPSTR &lpszKeyId, LPSTR &lpszAlgorithm);

class JWTSignerInfoEventParams {
public:
  const QString &KeyId();

  const QString &Algorithm();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void SignerInfo(JWTSignerInfoEventParams *e);

// Or, subclass JWT and override this emitter function.
virtual int FireSignerInfo(JWTSignerInfoEventParams *e) {...}

Remarks

This event fires with information about the signature. This may be used to help identify the Key or Certificate properties to load in order to verify the signature. This event fires when Verify or Parse is called.

KeyId is the Id of the key as supplied by the signer that created the message. This may be empty.

Algorithm is the signature algorithm used to sign the message.

Certificate Type

This is the digital certificate being used.

Syntax

IPWorksAuthCertificate (declared in ipworksauth.h)

Remarks

This type describes the current digital certificate. The certificate may be a public or private key. The fields are used to identify or select certificates.

Fields

Constructors

Certificate()

Certificate(const char* lpEncoded, int lenEncoded)

Certificate(int iStoreType, const char* lpStore, int lenStore, const char* lpszStorePassword, const char* lpszSubject)

HeaderParam Type

The JOSE header parameter.

Syntax

IPWorksAuthHeaderParam (declared in ipworksauth.h)

Remarks

This type holds the JOSE header parameters. The fields define the name, value, and data type of the parameter.

Fields

Constructors

HeaderParam()

HeaderParam(const char* lpszName, const char* lpszValue)

HeaderParam(const char* lpszName, const char* lpszValue, int iDataType)

JWTClaim Type

The claim within the JWT.

Syntax

IPWorksAuthJWTClaim (declared in ipworksauth.h)

Remarks

This type holds the claim information. The fields define the name, value, and data type of the claim value.

Fields

Constructors

JWTClaim()

JWTClaim(const char* lpszName, const char* lpszValue)

JWTClaim(const char* lpszName, const char* lpszValue, int iDataType)

IPWorksAuthList Type

Syntax

IPWorksAuthList<T> (declared in ipworksauth.h)

Remarks

IPWorksAuthList is a generic class that is used to hold a collection of objects of type T, where T is one of the custom types supported by the JWT class.

int GetCount() {}

int SetCount(int count) {}

T* Get(int index) {}

T* Set(int index, T* value) {}

Config Settings (JWT Class)

JWT Config Settings

-----BEGIN CERTIFICATE-----
MIIBujCCASOgAwIBAgICA+kwDQYJKoZIhvcNAQELBQAwHTEbMBkGA1UEAxMSbnVuaXRDZXJ0
Q2hhaW5Sb290MCAXDTE4MTAxNTA5MDAxN1oYDzIxMTgwOTIxMDkwMDE3WjAmMSQwIgYDVQQD
...
Tr+wi0ouNo7ifWRcE83Z15PhfGn1nkfxMYj4rya5n+V0RVVcgFUdiolCI5o/sYq503a7kH16
JSF5Zw+TiMz/COM8R94=
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIBsTCCARqgAwIBAgICA+gwDQYJKoZIhvcNAQELBQAwHTEbMBkGA1UEAxMSbnVuaXRDZXJ0
Q2hhaW5Sb290MCAXDTE4MTAxNTA5MDAxN1oYDzIxMTgwOTIxMDkwMDE3WjAdMRswGQYDVQQD
...
5u2K9PuJ3ySgL7AvYsqbB/e0/gw8j253SOU+gNTpFahOJsLGEJ43CRtaowkLnWEzs+OPnRfw
iQmqruw=
-----END CERTIFICATE-----

Base Config Settings

Trappable Errors (JWT Class)

Error Handling (C++)

Call the GetLastErrorCode() method to obtain the last called method's result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. Known error codes are listed below. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.

JWT Errors

JWS Errors

JWE Errors