JWE | Joint Embeddings of Chinese Words | Natural Language Processing library

You can implement a Web API endpoint that will accept your JWE token as an input parameter, decrypts and validates it and returns its payload (contents) as JSON. Then you can easily use JSON in your angular application. In this case you use your signing and encryption keys on the server-side where you keep them in secret.

Moreover, you may consider using JWT instead of JWE. You decode the token in a public client (angular app) in any case. That is similar to the user_info endpoint of OpenID Connect protocol. Encryption will be useful if you decrypt the token on the server-side (private client).

Using the signing and encryption keys in the angular application will expose them to the public.

Alternatively you can introduce another JWT token that is not encrypted and return it to your angular application instead of or in addition to your JWE token. It will be similar to the id_token from OpenID Connect protocol.

The decimal string representing the modulus must be converted to a hexadecimal string with the proper formatting. In the following code this is done by the convert function.
The example encrypts and decrypts a plaintext and is essentially taken from the description of js-jose. The converted modulus is used for the encryption.
The validity of the conversion can be cross checked e.g. here (and can of course also be concluded from the successful decryption):

True JWE with B2C isn’t possible yet. You can send claims to a REST API and send them back to B2C to encrypt them as a stop gap for now.

JWT Token issuer reference https://docs.microsoft.com/en-us/azure/active-directory-b2c/jwt-issuer-technical-profile

REST API usage https://docs.microsoft.com/en-us/azure/active-directory-b2c/custom-policy-rest-api-claims-exchange

The problem is that nimbus-jose-jwt-8.20-jdk6.jar does not support being run on Java 6, despite the appearance of 'jdk6' in its name.

You are getting the error you are seeing because the hashCode() method of the KeyUse class uses a method in the java.util.Objects utility class, and this class is only available from Java 7 onwards.

I would strongly recommend upgrading from Java 6, to Java 8 at least. Doing so would certainly get around this problem. However, if you are stuck with Java 6, you will have to get in contact with Connect2Id and ask them for support.

It happens that InputFormatterContext contains ModelState that I can populate with errors and it will go through all pipeline.

The AppServiceAuthSession is cookie which is different than a token. If you want to retrieve access token, we need to update the config of Azure app auth settings to make it acquire the access_token for the web API.

Regarding how to configure it, please refer to the following steps

1. Login to Resource Explorer

2. At the top of the page, select Read/Write.

3. In the left browser, navigate to subscriptions > resourceGroups > > providers > Microsoft.Web > sites > > config > authsettings.

4. Click Edit.

5. Modify the following property. Replace with the Azure Active Directory application ID of the service you want to access.

With help from the Keycloak community, I have identified that besides updating the pom.xml in the keycloak-parent and services projects, I also had to update the distribution project to include module definitions for the newly added dependency.

In my case I had to update the following module definition to indicate a new dependency

k is a base64url encoded representation of the octet key, unless the go interface specifically mentions passing keys in JWK format, which it doesn't, you need to provide the raw key. base64url.decode() the k to get the raw key bytes.

Also, as a sidenote, PBES2-HS256+A128KW is intended to be used with passwords, not keys, given it's computationally heavy i'd recommend a different key wrapping algorithm (not a symmetric passphrase based one). You can use asymmetric crypto to encrypt for a recipient. And if you also want to achieve authentication of the message, don't use key wrapping at all, use the Direct Key Agreement from JWE instead.

I found this library js-jose that can do exactly what I need. I added it as NuGet package, written following code: