HomeGuidesAPI Reference
API Reference
GuidesAPI ReferenceGitHubAirheads Developer Community
  1. Orchestrator REST APIs
  2. gmsRemoteAuth

Create JWT authentication configuration

post
http://127.0.0.1:8080/gmsRemoteAuth/JWT

Creates a new JWT (JSON Web Token) authentication configuration for SSO integration. Either a signing certificate (cert) or JWK URL (jwkUrl) must be provided for token signature verification. Configuration names must be unique across the system.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params

JWT configuration object. Either cert or jwkUrl must be provided.

JWT configuration object for creating a new SSO integration. Either cert or jwkUrl must be provided for token signature verification.

string
required

Unique display name for this JWT configuration. Must be unique across all JWT configs. Leading/trailing whitespace is trimmed.

string
required

Expected 'iss' (issuer) claim value in the JWT token. Must match the token's issuer exactly for validation.

string
required

Expected 'aud' (audience) claim value in the JWT token. Typically the client ID or API identifier from your identity provider.

string
required

JWT claim key that contains the username for login. Common values: 'email', 'preferred_username', 'sub'.

string

PEM-encoded X.509 certificate or public key for JWT signature verification. Required if jwkUrl is not provided.

uri

URL to the JSON Web Key Set (JWKS) endpoint for dynamic key retrieval. Required if cert is not provided.

string

JWT claim key containing RBAC role assignments. If empty or not provided, defaultRole is used for all users. Common values: 'groups', 'roles'.

string

Default RBAC role assigned when roleKey claim is missing or empty. Must match an existing Orchestrator role name.

string

JWT claim key for RBAC appliance access group assignments. If empty, no appliance group restrictions are applied.

integer
0 to 3600
Defaults to 0

Maximum allowed clock skew in seconds for token validation. Allows tokens within this time window of expiration. Range: 0-3600 (1 hour max).

string

Client secret for OIDC 3-step authorization flow. Required when using oidcUrl for server-side token exchange.

uri

OIDC token endpoint URL for 3-step authorization flow. When provided with clientSecret, enables server-side token exchange.

Responses

Updated about 12 hours ago

Did this page help you?
Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated about 12 hours ago

Did this page help you?