iSHARE Developer Portal
Other resources
Version 2.1 (current version)
Version 2.1 (current version)
  • Welcome to the iSHARE Developer Portal
  • Introduction
    • Getting started
      • Test certificates
      • Test participants
      • Postman collections
    • Release info
    • Help & support
    • Specific technical standards
      • JSON Web Token (JWT)
      • OAuth 2.0
      • OpenID Connect 1.0
      • PKI
      • TLS
      • XACML 3.0
      • Caching
      • DID
      • UTC
      • X.509
      • HTTP response codes
    • UI Guidelines
    • Conformance test tool
  • Roles
    • Roles
  • All roles (common endpoints)
    • Access token (M2M)
    • Capabilities
  • Authorisation Registry Role
    • Getting started
    • Access token (M2M)
    • Capabilities
    • Delegation
    • Delegation Policy
  • Entitled Party
    • Getting started
  • Identity Provider
    • Getting started
    • Authorize
    • Login
    • Access token
    • User info
    • Capabilities
  • Participant Registry role
    • Getting started
    • Access token (M2M)
    • Capabilities
    • Parties
    • Parties (single party)
    • Trusted list
    • Versions
    • Data Spaces
    • Create Entitled Party / Service Consumer
  • Service Consumer Role
    • Getting started
  • Service Provider Role
    • Getting started
      • Service
    • Access token (M2M)
    • Capabilities
    • Return
  • Reference
    • iSHARE JWT
      • Client Assertion
    • Authentication
    • Authorization
    • Authorisation rules
Powered by GitBook
LogoLogo

  • Cookie Policy

  • Privacy Policy

  • Imprint

  • Contact Us

Copyright © 2024 iSHARE Foundation

On this page
  1. Reference
  2. iSHARE JWT

Client Assertion

PreviousiSHARE JWTNextAuthentication

Last updated 2 months ago

This page must be considered part of the iSHARE Framework

This page is considered normative and is therefore compliant with RFC 2119.

This page defines the JWT payload that should be provided to generate an iSHARE JWT client assertion for the

JWT Payload

Instead of the default payload requirements, the following apply:

  • The iss and sub claims MUST contain a valid of the client that wishes to authenticate.

  • The aud claim MUST contain only a valid of the party that authenticates the client. Including multiple audiences creates a risk of impersonation and is therefore not allowed.

In OAuth 2.0 clients are generally pre-registered. Since in iSHARE servers interact with clients that may have been previously unknown, this is not a workable requirement. Therefore iSHARE implements a generic client identification and authentication scheme, based on iSHARE whitelisted PKIs.

Since OAuth 2.0 doesn’t specify a PKI based authentication scheme, but OpenID Connect 1.0 does, iSHARE chooses to use the scheme specified by OpenID Connect in all use cases. This is preferred above defining a new proprietary scheme.

Example Client Assertion JWT Payload:

{
  "iss": "did:ishare:EU.NL.NTRNL-10000001",
  "sub": "did:ishare:EU.NL.NTRNL-10000001",
  "aud": "did:ishare:EU.NL.NTRNL-10000000",
  "jti": "378a47c4-2822-4ca5-a49a-7e5a1cc7ea59",
  "exp": 1504683475,
  "iat": 1504683445
}
access token endpoint.
iSHARE JWT
Party Identifier
Party Identifier