Retrieving the JWT token from WSO2 IS using SSO OIDC authentication protocol - node.js

Question

I am implementing a basic NodeJS app that connects to WSO2 Identity Server for authentication.
I configured it using SSO with openid-connect. When I receive the callback, the jwt token is returned as a fragment identifier as I think it is returned as a GET request. How do I retrieve this JWT from the server side itself?
This is how the URL looks like when I try to login
https://localhost:9443/oauth2/authorize?response_type=id_token&client_id={CLIENT_ID}&scope=openid%20profile%20email&nonce=aaa&redirect_uri=http://localhost:3001/auth/callback
replaced the client_id with the actual client_id from what the Service Provider gave
this is a sample of how WSO2 returns the callback.
http://localhost:3001/auth/callback#id_token={TOKEN}

Answer 1

If you are using JAVA for your back-end development you can use a servlet filter to intercept this JWT token and process it. Following is a sample filter that you can use. You can use WSO2 Application Server to deploy your application.
public class JWTAction implements Filter {
private static final Logger logger = Logger.getLogger(JWTAction.class);
private static final PropertyReader propertyReader = new PropertyReader();
/**
* This method is for get public key
*
* #return return for getting public key
* #throws IOException if unable to load the file
* #throws KeyStoreException if unable to get instance
* #throws CertificateException if unable to certify
* #throws NoSuchAlgorithmException cause by other underlying exceptions(KeyStoreException)
*/
private static PublicKey getPublicKey() throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException {
InputStream file = Thread.currentThread().getContextClassLoader()
.getResourceAsStream(propertyReader.getSsoKeyStoreName());
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
//loading key store with password
keystore.load(file, propertyReader.getSsoKeyStorePassword().toCharArray());
Certificate cert = keystore.getCertificate(propertyReader.getSsoCertAlias());
return cert.getPublicKey();
}
public void init(FilterConfig filterConfig) {
}
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
FilterChain filterChain) throws IOException {
HttpServletRequest request = (HttpServletRequest) servletRequest;
HttpServletResponse response = (HttpServletResponse) servletResponse;
String jwt = request.getHeader("X-JWT-Assertion");
String ssoRedirectUrl = propertyReader.getSsoRedirectUrl();
if (jwt == null || "".equals(jwt)) {
if (logger.isDebugEnabled()) {
logger.debug("Redirecting to {}");
}
response.sendRedirect(ssoRedirectUrl);
return;
}
String username = null;
String roles = null;
try {
SignedJWT signedJWT = SignedJWT.parse(jwt);
JWSVerifier verifier = new RSASSAVerifier((RSAPublicKey) getPublicKey());
if (signedJWT.verify(verifier)) {
if (logger.isDebugEnabled()) {
logger.debug("JWT validation success for token: {}");
}
username = signedJWT.getJWTClaimsSet().getClaim("http://wso2.org/claims/emailaddress").toString();
roles = signedJWT.getJWTClaimsSet().getClaim("http://wso2.org/claims/role").toString();
if (logger.isDebugEnabled()) {
logger.debug("User = {" + username + "} | Roles = " + roles);
}
} else {
logger.error("JWT validation failed for token: {" + jwt + "}");
response.sendRedirect(ssoRedirectUrl);
return;
}
} catch (ParseException e) {
logger.error("Parsing JWT token failed");
} catch (JOSEException e) {
logger.error("Verification of jwt failed");
} catch (Exception e) {
logger.error("Failed to validate the jwt {" + jwt + "}");
}
if (username != null && roles != null) {
request.getSession().setAttribute("user", username);
request.getSession().setAttribute("roles", roles);
}
try {
filterChain.doFilter(servletRequest, servletResponse);
} catch (ServletException e) {
logger.error("Failed to pass the request, response objects through filters", e);
}
}
public void destroy() {
}
}