Xtykutl

we are using WSO2 API Manager version 2.5 and Identity Server 5.6 where the IS is the key manager for the API Manager.

I enabled JWT in the IS config.
Added a custom claim dialect with userid and roles (as we do not need everything the local claim includes and it leads to errors in backend because the header is to big)

When I call an API the JWT is generated and passed on. However - the roles claim is not working in my custom dialect.
When I use the local claim dialect for JWT the roles are included in the token.

My Config:

 <JWTConfiguration>

    <JWTHeader>X-JWT-Assertion</JWTHeader

    <JWTGeneratorImpl>org.wso2.carbon.apimgt.keymgt.token.JWTGenerator</JWTGeneratorImpl>

    <ClaimsRetrieverImplClass>org.wso2.carbon.apimgt.impl.token.DefaultClaimsRetriever</ClaimsRetrieverImplClass>

    <ConsumerDialectURI>http://ourdomain.com/jwt</ConsumerDialectURI>

    <SignatureAlgorithm>SHA256withRSA</SignatureAlgorithm>

    <EnableJWTGeneration>true</EnableJWTGeneration>

</JWTConfiguration>

The http://ourdomain.com/jwt dialect looks like this:

http://ourdomain.com/jwt/uid

    Claim URI   http://ourdomain.com/jwt/uid

    Mapped Local Claim  http://wso2.org/claims/our/uid

http://ourdomain.com/jwt/fullname

    Claim URI   http://ourdomain.com/jwt/fullname

    Mapped Local Claim  http://wso2.org/claims/fullname

http://ourdomain.com/jwt/accountNr

    Claim URI   http://ourdomain.com/jwt/accountNr

    Mapped Local Claim  http://wso2.org/claims/accountNr

http://ourdomain.com/jwt/role

    Claim URI   http://ourdomain.com/jwt/role

    Mapped Local Claim  http://wso2.org/claims/role 

This is the resulting JWT content:

{

  "http://ourdomain.com/jwt/version": "1.0.0",

  "http://ourdomain.com/jwt/applicationid": "90",

  "http://ourdomain.com/jwt/keytype": "SANDBOX",

  "http://ourdomain.com/jwt/uid": "123",

  "http://ourdomain.com/jwt/enduser": "mail.address@ourdomain.com@carbon.super",

  "http://ourdomain.com/jwt/subscriber": "EXTERNAL/subscriber@ourdomain.com",

  "iss": "wso2.org/products/am",

  "http://ourdomain.com/jwt/fullname": "Mail Address",

  "http://ourdomain.com/jwt/applicationtier": "Unlimited",

  "http://ourdomain.com/jwt/applicationname": "application",

  "http://ourdomain.com/jwt/enduserTenantId": "-1234",

  "http://ourdomain.com/jwt/tier": "Unlimited",

  "http://ourdomain.com/jwt/usertype": "APPLICATION_USER",

  "http://ourdomain.com/jwt/accountNr": [

    "123451",

    "123452",

    "123453"

  ],

  "http://ourdomain.com/jwt/apicontext": "/heimdall/1.0.0",

  "exp": 1541605849

}

Any leads where I'm mistaken? Do I have to write a custom token generator?