System, method, and computer program for client authentication and authorization in oracle tuxedo using JSON web tokens

1 . A non-transitory computer-readable media storing computer instructions which when executed by one or more processors of a device cause the device to:

receive, by a server that operate as a middleware platform to manage distributed transaction processing in a distributed computing environment comprised of a plurality of client devices, a service call from one of the client devices, wherein the service call is comprised of a plurality of JavaScript Object Notation (JSON) web tokens that include:

an identifier token held by the client device, and

an access token that has been provided to the client device by an identity provider (IDP);

validate the plurality of JSON web tokens, directly by the server, to authenticate and authorize the client device; and

provide to the client device a response to the service call, by the server, based on a result of the validating.

2 . The non-transitory computer-readable media of claim 1 , wherein the identifier token is issued to the client device or generated by the client device.

3 . The non-transitory computer-readable media of claim 1 , wherein the plurality of JSON web tokens included in the service call include a proof of possession token comprised of at least a hash of one or more portions of the service call.

4 . The non-transitory computer-readable media of claim 3 , wherein the proof of possession token is generated by the client device.

5 . The non-transitory computer-readable media of claim 1 , wherein the plurality of JSON web tokens are signed by the client device using a private key of the client device.

6 . The non-transitory computer-readable media of claim 1 , wherein the server stores a list of trusted issuers.

7 . The non-transitory computer-readable media of claim 6 , wherein the server obtains the list of trusted issuers responsive to an initial service call received by the server and caches the list of trusted issuers for use upon receipt of subsequent service calls received by the server.

8 . The non-transitory computer-readable media of claim 6 , wherein the server uses the list of trusted issuers to validate at least a portion of the plurality of JSON web tokens.

9 . The non-transitory computer-readable media of claim 1 , wherein the server stores a list of trusted client identifiers.

10 . The non-transitory computer-readable media of claim 9 , wherein the server uses the list of trusted client identifiers to validate at least a portion of the plurality of JSON web tokens.

11 . The non-transitory computer-readable media of claim 1 , wherein the response to the service call indicates a service failure when the validating of any of the plurality of JSON web tokens fails, and wherein the service failure causes the client device to be prevented from accessing a service of the server.

12 . The non-transitory computer-readable media of claim 1 , wherein the response to the service call indicates a service success when the validating of all of the plurality of JSON web tokens succeeds, and wherein the service success causes the client device to be granted access to a service of the server.

13 . The non-transitory computer-readable media of claim 1 , wherein the validating is performed to secure the server against an unauthorized service call comprised of an attack being made via the service call.

14 . The non-transitory computer-readable media of claim 1 , wherein the plurality of JSON web tokens are stored in a fielded buffer of the service call.

15 . The non-transitory computer-readable media of claim 1 , wherein the identifier token uniquely identifies the client device.

16 . The non-transitory computer-readable media of claim 1 , wherein the server validates the identifier token by:

accessing properties of the client device included in a properties file,

fetching a valid list of issuers based on an environment type,

extracting a token issuer from the identifier token,

validating the token issuer using the valid list of issuers,

responsive to validating the token issuer, retrieving a JSON Web Key Set (JWKS) uniform resource locator (URL) from the token issuer,

using the JWKS URL to obtain a list of keys,

extracting a key from the identifier token,

validating that the key is included in the list of keys,

responsive to validating that the key is included in the list of keys, validating that a signature of the identifier token is valid and that the identifier token is not expired, and

validating the identifier token in response to validating that a signature of the identifier token is valid and that the identifier token is not expired.

17 . The non-transitory computer-readable media of claim 1 , wherein the server validates the identifier token by:

accessing properties of the client device included in a properties file,

fetching a valid list of issuers based on an environment type,

extracting a token issuer from the access token,

validating the token issuer using the valid list of issuers,

responsive to validating the token issuer, extracting an audience claim from the access token based on the token issuer,

validating the audience claim,

responsive to validating the audience claim, retrieving a JSON Web Key Set (JWKS) uniform resource locator (URL) from the token issuer,

using the JWKS URL to obtain a list of keys,

extracting a key from the access token,

validating that the key is included in the list of keys,

responsive to validating that the key is included in the list of keys, validating that a signature of the access token is valid and that the access token is not expired, and

validating the access token in response to validating that a signature of the access token is valid and that the access token is not expired.

18 . A method, comprising:

at a computer system:

receiving, by a server that operate as a middleware platform to manage distributed transaction processing in a distributed computing environment comprised of a plurality of client devices, a service call from one of the client devices, wherein the service call is comprised of a plurality of JavaScript Object Notation (JSON) web tokens that include:

an identifier token held by the client device, and

an access token that has been provided to the client device by an identity provider (IDP);

validating the plurality of JSON web tokens, directly by the server, to authenticate and authorize the client device; and

providing to the client device a response to the service call, by the server, based on a result of the validating.

19 . A system, comprising:

a non-transitory memory storing instructions; and

one or more processors in communication with the non-transitory memory that execute the instructions to:

receive, by a server that operate as a middleware platform to manage distributed transaction processing in a distributed computing environment comprised of a plurality of client devices, a service call from one of the client devices, wherein the service call is comprised of a plurality of JavaScript Object Notation (JSON) web tokens that include:

an identifier token held by the client device, and

an access token that has been provided to the client device by an identity provider (IDP);

validate the plurality of JSON web tokens, directly by the server, to authenticate and authorize the client device; and

provide to the client device a response to the service call, by the server, based on a result of the validating.