Example Configuration
jwtAuth:
expectedAud: my-audience
expectedIss: https://auth.example.com
expectedTid: 67c859d3-0cd4-4a99-86db-088bed1a9601
jwks: {}
jwtAuth:
expectedAud: my-audience
expectedIss: https://auth.example.com
expectedTid: 67c859d3-0cd4-4a99-86db-088bed1a9601
jwks: {}
Syntax
jwtAuth:
'$ref': <string>
expectedAud: <string>
expectedIss: <string>
expectedTid: <string>
headerJwtRetriever: {}
jwks: {}
scopesClaim: <string>
jwtAuth:
'$ref': <string>
expectedAud: <string>
expectedIss: <string>
expectedTid: <string>
headerJwtRetriever: {}
jwks: {}
scopesClaim: <string>
Attributes
| Name | Required | Default | Description | Examples |
|---|---|---|---|---|
| $ref | false | - | Reference a component defined under components. | - |
| expectedAud | false | - | Expected audience ('aud') value of the token. Use "any!!" to allow any audience value. This is strongly discouraged. | - |
| expectedIss | false | not set | Expected issuer ('iss') value of the token. If set, tokens without an 'iss' claim or with a different issuer are rejected. | https://auth.example.com |
| expectedTid | false | not set | Expected tenant ID ('tid') value of the token. | 67c869d3-0cd4-4a99-86db-088bed1a9601 |
| scopesClaim | false | scp | Name of the claim that carries the token's scopes, e.g. "scp" (Microsoft Entra ID) or "scope" (RFC 9068). The claim may hold a space separated string or a list of strings. The scopes are used by the OpenAPI security validation. | scope |
Child Structure
| Element | Cardinality | Description |
|---|---|---|
| headerJwtRetriever | 0..1 | |
| jwks | 0..1 | JSON Web Key Set, configured either by an explicit list of JWK or by a list of JWK URIs. |