JWT Mechanism | Teradata Vantage - JWT Mechanism - Analytics Database - Teradata Vantage

The JSON Web Token (JWT) authentication mechanism enables single sign-on (SSO) to Teradata Vantage after the user successfully authenticates to Teradata UDA User Service. The UDA User Service authenticates users to various UDA applications and services, such as AppCenter and the Teradata® Query Service (REST services). JWT allows a user that has been authenticated to one of the applications or services to do a single sign-on to establish a session withTeradata Vantage.

You can modify some JWT support properties without performing a TPA reset. For example, you can modify MechanismEnabled and any mechanism property that begins with JWT. You can also add, remove, and modify <IdentityProvider> and <UserNameMapping> elements without a TPA reset. run_tdgssconfig indicates when you need to do a TPA reset.

JWT Library Configuration: TdgssLibraryConfigFile.xml

<!-- JWT: JSON Web Token -->

<Mechanism Name="JWT"
    ObjectId="1.3.6.1.4.1.28698.4.302.1.4"
    LibraryName="gssp2jwt"
    Prefix="JWT"
    InterfaceType="custom">

    <MechanismProperties
        AuthenticationSupported="yes"
        AuthorizationSupported="no"
        SingleSignOnSupported="yes"

        NegotiationSupported="no"
        DefaultNegotiatingMechanism="no"

        DefaultMechanism="no"
        MechanismEnabled="yes"
        MechanismRank="30"
        MechanismIgnoresQop="no"

        GenerateCredentialFromLogon="yes"

        DelegateCredentials="no"
        MutualAuthentication="no"
        ReplayDetection="yes"
        OutOfSequenceDetection="yes"
        ConfidentialityDesired="yes"
        IntegrityDesired="yes"
        AnonymousAuthentication="no"
        DesiredContextTime=""
        DesiredCredentialTime=""
        CredentialUsage="0"

DHKeyP2048="8AB3F86E8D374B782F31DAD5F27D6AFDA30150C11A20CF6346712AE2D2C6B70A5B79D45D4C0C232A065B207B121B2C33E147B5983C38A1087F272703B0B839CBA6F71C5D0EB51EC890934EACF2C7DD2A1DF6F55E89B145A0359D35EF8FB6C561E157B13FF927A35E69963648614902B1034EF71197F545DEF3236244EADAE0689E624CF1245953630AE042BD797C4025E37C51D9F6CBDA0B2278FA7D5CA2D9CA930BE2968330C811A4BA4D0845333C0D62E3EE742154F6B62F2951CD8C73C43B5AA1C7819DEF1D7C9314411E465F8E4796666594AADE0AEB3F1256E5719E7AE54DD34FFDA949634E4A293C5BC60AF258BB9FE558086E83B3DD3D7491966DEE93"8FA7D5CA2D9CA930BE2968330C811A4BA4D0845333C0D62E3EE742154F6B62F2951CD8C73C43B5AA1C7819DEF1D7C9314411E465F8E4796666594AADE0AEB3F1256E5719E7AE54DD34FFDA949634E4A293C5BC60AF258BB9FE558086E83B3DD3D7491966DEE93"
DHKeyG2048="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005"

        JWTDecryptionKeyFile=""
        JWTVerificationKeyFile=""
        JWTSkewTime="300"
        JWTKeyDirectory=""
        JWTDynamicKey="no"
        JWTTokenExchange="no"
        JWTClientTlsCACertDir=""
        JWTKeyCacheRefreshTime="1440"
        JWTClientUseTls="yes"
        JWTRestAPITimeLimit="10"
        JWTRestAPIMaxTimeAllowed="20"
        />

    <!-- Low, Medium and High QOP values are all set to "Default"
         unless the Low, Medium and High values are explicitly set
         in TdgssUserConfigFile.xml  -->

    <!-- DEFAULT QOP -->
    <MechQop Value="Default">
        AES-K128_AEADGCM_PKCS5Padding_SHA2_DH-K2048
        AES-K192_AEADGCM_PKCS5Padding_SHA2_DH-K2048
        AES-K256_AEADGCM_PKCS5Padding_SHA2_DH-K2048
        AES-K128_GCM_PKCS5Padding_SHA2_DH-K2048 
        AES-K192_GCM_PKCS5Padding_SHA2_DH-K2048
        AES-K256_GCM_PKCS5Padding_SHA2_DH-K2048
        AES-K128_CBC_PKCS5Padding_SHA1_DH-K2048
        AES-K192_CBC_PKCS5Padding_SHA1_DH-K2048
        AES-K256_CBC_PKCS5Padding_SHA1_DH-K2048
    </MechQop>

</Mechanism>

Example: JWT in the User Configuration File

The following is a snippet from TdgssUserConfigFile.xml showing the JWT mechansim:

<!-- JWT -->
  <!-- To modify JWT mechanism configuration, uncomment this section and edit -->
    <Mechanism Name="JWT">
       <MechanismProperties
           MechanismEnabled="yes"
           DefaultMechanism="no"

           JWTDynamicKey="yes"
           JWTTokenExchange="yes"
           JWTClientTlsCACertDir="/etc/ssl/certs"
      />

     <TokenExchanger
           Ref="Ping1"
           ClientId="account"
           ClientSecret="Y2I2OGZkZTctM2FjMC00OWQwLWIzMGUtODJjMGIxNTY2NzAy"
           ClientSecretProtected="yes"
      />

     <IdentityProvider
           Id="Keycloa21"
           Url="https://keycloak1/auth/realms/uda"
           Type="keycloak"
           ValidateByTokenExchange="yes"
     />

     <IdentityProvider
           Id="ping1"
           Url="ping_provider_URL"
           Type="PingFederate"
           ValidateByTokenExchange="no"
     />

    <UserNameMapping
           Claim="given_name"
           Match="(\w+)"
           DatabaseName="${1}" 
    />

    <UserNameMapping
           Claim="sub"
           Match="(\w+).*.com"
           DatabaseName="${1}" 
    />

    <UserNameMapping
           Claim="preferred_username"
           Match="(\w+)@(\w+).com"
           DatabaseName="${1}" 
    />
    </Mechanism>
   (end of commented out section)-->

Related Information

For more information about JWT, see https://tools.ietf.org/html/rfc7519.

For more information about configuring JWT, see Configuring Single Sign-On.

For more information about JWT properties, see JWT Support Properties.