8

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the difference between the reserved iss and aud claims. I understand that the one defines the server that is issuing out the token and the one refers to the application that is intended for use. But the way I understand that is that my audience and issuer are the same thing myserver.com is issuing the token so that people who come to myserver.com can be authorized and authenticated. I guess I don't see the differentiation between the two claims, although I know there is one.
There was a good article written at msdn on all of the reserved claims and that's where I got most confused because they had their issuer and audience completely different.

7

These are intended for scenarios where you have a token issuing authority that is not the same as the application that is the intended recipient.

This may not be different for your application.

But consider a large scaled application. You might have an OAuth or SSO server that's issuing the certificates, and an application that wants a token that shows the SSO server has checked the user's credentials and has approved the user to use the application. In that case, you might have a token with "aud": "aud.example.com" and "iss": "sso.example.com".

  • Oh I see. It was a misunderstanding on my part because I thought two things: 1. You had to have both "iss" and "aud" as part of the claims. 2. They had to be unique to each other. This obviously is not the truth. So, if you have an application such as mine, would you even include those two claims in your jwt or leave them out since they would be identical? – Adam McGurk Sep 5 '17 at 2:01
  • You could certainly leave them out and add them later when you have a reason to use it – Paul Sep 5 '17 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.