API Access and Identity Tokens
All tokens issued by the Authorization Server should follow the JSON Web Token (JWT) standard. Tokens must be signed with the SOTI Cloud Link Agent Authorization Server’s signing certificate.
You can configure the signing certificate using PowerShell. Learn more at PowerShell Commands.
The signing certificate must have:
- A signature (SHA-256)
- An RSA key with the length 2048
- A validity period of 2 years.
- Extended Key Usage
XCN_OID_KP_DOCUMENT_SIGNING(1.3.6.1.4.1.311.10.3.12)
- The recommended API: JwtSecurityTokenHandler class.
Audience
Each API method must validate the audience in the JWT to ensure that the client is authorized by the Authorization Server to call the particular API.
Validation
Each API method must have full JWT validation as described in JSON Web Token Best Current Practices.
JWT Validity Period
You can edit token validity periods with PowerShell. The following default settings are recommended:
- Authenticated user identity token: 5 minutes
- API access token: up to 30 minutes
See the OWASP Cheat Sheet Series: Session Management Cheat Sheet for more information.