OAuth 2.0-based authentication of users and devices, user profile management, Single Sign-On (SSO) and Identity Federation across multiple administration domains.
The problem comes from the aud field. It's an Array when it should be a string, as confirmed by the iShare documentation.
The aud claim MUST contain only the valid iSHARE identifier of the server. Including multiple audiences creates a risk of impersonation and is therefore not allowed.
As part of an i4Trust.org experiment, I want to use Keyrock as Authorization Registry.
When Keyrock tries to obtain a token from the iShare satellite, an error occurs:
This is because the iShare JWT passed in the client_assertion field is not properly formed:
The problem comes from the aud field. It's an Array when it should be a string, as confirmed by the iShare documentation.
The token should be formed as follows: