Apex Reference Guide

Apex Reference Guide
Release Notes
Apex DML Operations
ApexPages Namespace
AppLauncher Namespace
Approval Namespace
Auth Namespace
AuthConfiguration Class
AuthProviderCallbackState Class
AuthProviderPlugin Interface
AuthProviderPluginClass Class
AuthProviderTokenResponse Class
AuthToken Class
CommunitiesUtil Class
ConfigurableSelfRegHandler Interface
ConfirmUserRegistrationHandler Interface
ConnectedAppPlugin Class
HeadlessSelfRegistrationHandler Interface
IntegratingAppType Enum
InvocationContext Enum
JWS Class
JWT Class
JWTBearerTokenExchange Class
JWTUtil Class
JWTUtil Methods
LightningLoginEligibility Enum
LoginDiscoveryHandler Interface
LoginDiscoveryMethod Enum
MyDomainLoginDiscoveryHandler Interface
Oauth2TokenExchangeHandler Class
OAuth2TokenExchangeType Enum
OAuthRefreshResult Class
OauthToken Class
OauthTokenType Enum
RegistrationHandler Interface
SamlJitHandler Interface
SessionManagement Class
SessionLevel Enum
TokenValidationResult Class
UserData Class
VerificationMethod Enum
VerificationPolicy Enum
VerificationResult Class
Auth Exceptions
Cache Namespace
Canvas Namespace
ChatterAnswers Namespace
CommerceOrders Namespace
CommercePayments Namespace
CommerceTax Namespace
Compression Namespace (Developer Preview)
ConnectApi Namespace
Database Namespace
Datacloud Namespace
DataSource Namespace
DataWeave Namespace
Dom Namespace
EventBus Namespace
ExternalService Namespace
Flow Namespace
FormulaEval Namespace (Developer Preview)
Functions Namespace
Invocable Namespace
IsvPartners Namespace
KbManagement Namespace
LxScheduler Namespace
Messaging Namespace
Metadata Namespace
PlaceQuote Namespace
Pref_center Namespace
Process Namespace
QuickAction Namespace
Reports Namespace
RichMessaging Namespace
Schema Namespace
Search Namespace
Sfc Namespace
Sfdc_Checkout Namespace
sfdc_surveys Namespace
Site Namespace
Slack Namespace
Support Namespace
System Namespace
TerritoryMgmt Namespace
TxnSecurity Namespace
UserProvisioning Namespace
VisualEditor Namespace
Wave Namespace
Appendices
PDF

Newer Version Available

This content describes an older version of this product. View Latest

JWTUtil Class

Contains methods for validating a JSON Web Token (JWT) from an external identity provider as part of the OAuth 2.0 token exchange flow. Use these methods as part of the validateIncomingToken method in the Auth.Oauth2TokenExchangeHandler class.

Namespace

Auth

Usage

See Token Exchange Handler Validation and Subject Mapping.

If the methods in this class fail, Salesforce returns an Auth.JWTValidationException exception.

JWTUtil Methods

The following are methods for JWTUtil.

parseJWTFromStringWithoutValidation(incomingJWT)

Parses a JWT from an encoded string into a header, payload, and signature. Use this method to decode the JWT without validating it.

Signature

public static Auth.JWT parseJWTFromStringWithoutValidation(String incomingJWT)

Parameters

incomingJWT
Type: String
The JWT from your identity provider.

Return Value

Type:Auth.JWT

validateJWTWithCert(incomingJWT, certDeveloperName)

Parses and validates the JWT using a certificate saved in Salesforce. The certificate can be self-signed or signed by a certificate authority.

Signature

public static Auth.JWT validateJWTWithCert(String incomingJWT, String certDeveloperName)

Parameters

incomingJWT
Type: String
The JWT from your identity provider.
certDeveloperName
Type: String
A certificate saved in the Certificate and Key Management page in Setup.

Return Value

Type: Auth.JWT

validateJWTWithKey(incomingJWT, publicKey)

Parses and validates the JWT using a public key from the external identity provider.

Signature

public static Auth.JWT validateJWTWithKey(String incomingJWT, String publicKey)

Parameters

incomingJWT
Type: String
The JWT from your identity provider.
publicKey
Type: String
The public key from your identity provider.

Return Value

Type: Auth.JWT

validateJWTWithKeysEndpoint(incomingJWT, keysEndpoint, shouldUseCache)

Parses and validates the JWT using a remote JSON Web Key Set (JWKS) endpoint on your external identity provider.

Signature

public static Auth.JWT validateJWTWithKeysEndpoint(String incomingJWT, String keysEndpoint, Boolean shouldUseCache)

Parameters

incomingJWT
Type: String
The JWT from your identity provider.
keysEndpoint
Type: String
A URL pointing to a valid JWKS endpoint on your identity provider. The JWKS returned by the endpoint must conform to the specification defined in RFC 7517: JSON Web Key (JWK).
shouldUseCache
Type: Boolean
Indicates whether the certificate from the keys endpoint is cached.

Return Value

Type: Auth.JWT