Create a user in Collibra for your client application account.
Provide a meaningful first and last name to identify that this is a service account.
The encryption algorithm.
Collibra supports all standard encryption algorithms.
| | kid |The JWKS identifier of the public key used to sign the JWT token.
An identity provider may have multiple public key certificates, for example multiple valid keys may exist while a key rotation is in progress.
| | | typ |Optional field that defines the JWT type.
Use the MIME type format, for example application/jwt or application/secevent+jwt with the application/ prefix removed, for example jwt or secevent+jwt.
The issuer of the token.
This field is used to check the token comes from the expected IdP.
| | exp | The token expiry time. | | | iat | The time the token was issued. | | | sub | The subject or the principal ID. | | | Signature | |The digital signature of the header and payload.
The signature verifies the message did not change along the way. In the case of tokens signed with a private key, the signature also verifies the authenticity of the JWT sender.
| ## Configure JWT settings To enable or change the JSON Web Token configuration: {% stepper %} {% step %} Open Collibra Console.\ :chevrons-right: Collibra Console opens with the **Infrastructure** page. {% endstep %} {% step %} In the tab pane, expand an environment to show its services. {% endstep %} {% step %} In the tab pane, click the Data Governance Center service of that environment. {% endstep %} {% step %} Click **Configuration**. {% endstep %} {% step %} Click **Edit configuration**. {% endstep %} {% step %} In the **JWT** section, make the necessary changes. | Setting | Description | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | JSON Web Key Set URL |The URL to retrieve public key information needed to verify the authenticity of JSON Web Tokens (JWTs), issued by an authorization server.
This setting is required to enable JWT authentication.
| | JWT Token Types |A case-insensitive comma-separated list of accepted JWT media types coming in the typ header parameter.
Leave blank if the authorization server does not provide a media type parameter.
The default values is at+jwt,jwt.
| | JWT Algorithms |A comma-separated list of accepted JWT algorithms coming in the alg header parameter. See
Leave blank to accept all digital signature algorithms.
| | JWT Issuer |The accepted issuer coming in the iss JWT claim.
Leave blank if the authorization server does not provide an issuer claim.
| | JWT Audience |A comma-separated list of accepted audience values for the aud claim.
The value for this field is a configuration setting in your authorization server, which identifies your Collibra environment as the intended recipient of the JWT.
Leave blank if the authorization server does not provide an audience claim.
| | JWT Principal ID Claim Name. |The name of the JWT claim containing the principal's identity. See
Defaults to the standard subject claim, sub.
Change this setting only if your authorization server has other means of identifying the principal, for example, a client\_id claim.
This setting is required if JWT authentication is enabled.
| | JWT Maximum Clock Skew |The maximum acceptable difference in seconds between the clocks of the machines running the authorization server and Collibra.
Differences smaller than the given amount are ignored when performing time comparisons for token validation.
The default value is 60 seconds if left blank.
| | {% endstep %} | | {% step %} Click Save all. {% endstep %} {% step %} Restart the environment to apply your changes. See [Stop an environment](https://productresources.collibra.com/docs/collibra/latest/Default.htm#cshid=DOC0512) and [Start an environment](https://productresources.collibra.com/docs/collibra/latest/Default.htm#cshid=DOC0510). {% endstep %} {% endstepper %} ## JWT troubleshooting The following table contains JWT authentication error codes that may appear in the body of the **401 Unauthorized** HTTP response. You can use the error codes to determine the appropriate course of action for your application. | Error code | Description | Possible action | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | malformedToken | The JWT token is incorrectly encoded or has an incorrect syntax. | Check your IdP configuration to make sure it is returning a token in JWT format. | | expiredToken | The JWT token has expired. | In your application, request a new token from the IdP and retry. | | invalidToken |The JWT token is invalid.
Common causes are: