Fix: Improve Azure AD Key Manager documentation [master] #10467
Conversation
wso2-engineering-bot
requested review from
chamilaadhi and
tharikaGitHub
as code owners
WalkthroughDocumentation updates to the Azure AD Key Manager configuration guide: a concrete example URL is added to the Scope Management Endpoint table cell, and the troubleshooting section is revised to guide users toward JWT decoding via jwt.io for issuer verification instead of direct instruction. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
en/docs/administer/key-managers/configure-azure-ad-key-manager.md(2 hunks)
🔇 Additional comments (1)
en/docs/administer/key-managers/configure-azure-ad-key-manager.md (1)
155-155: Example URL enhances clarity for Scope Management Endpoint configuration.The concrete example URL follows the established documentation pattern and provides helpful guidance for users configuring this endpoint. The HTML entity encoding is consistent with other examples in the table.
| } | ||
| ``` | ||
| Please verify that the `iss` (issuer) claim in the token matches the issuer configured in the Key Manager Endpoints section. If there is a difference, update the issuer in the Key Manager Endpoints section to align with the `iss` value present in the token. | ||
| Please verify that the `iss` (issuer) claim in the token matches the issuer configured in the Key Manager Endpoints section. To obtain the `iss` value from the token, decode the JWT token (you can use tools like [jwt.io](https://jwt.io) or similar JWT decoder) and check the `iss` claim in the payload. If there is a difference, update the issuer in the Key Manager Endpoints section to align with the `iss` value present in the token. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check if file exists and read line 217 with context
if [ -f "en/docs/administer/key-managers/configure-azure-ad-key-manager.md" ]; then
echo "File found. Reading lines 210-220..."
sed -n '210,220p' "en/docs/administer/key-managers/configure-azure-ad-key-manager.md" | cat -n
else
echo "File not found at expected path. Searching..."
find . -name "configure-azure-ad-key-manager.md" 2>/dev/null
fiRepository: wso2/docs-apim
Length of output: 912
Add security caveat when recommending public JWT decoders.
The current guidance recommends jwt.io without warning users about the risks of pasting production tokens containing sensitive claims. For administrators troubleshooting "Invalid Credentials" errors, this creates a risk of exposing secrets or personally identifiable information to a public service.
Recommend offline tools (command-line JWT decoders, IDE extensions, browser developer tools) as the preferred approach, and add an explicit warning against pasting production or sensitive tokens to public online services.
- Please verify that the `iss` (issuer) claim in the token matches the issuer configured in the Key Manager Endpoints section. To obtain the `iss` value from the token, decode the JWT token (you can use tools like [jwt.io](https://jwt.io) or similar JWT decoder) and check the `iss` claim in the payload. If there is a difference, update the issuer in the Key Manager Endpoints section to align with the `iss` value present in the token.
+ Please verify that the `iss` (issuer) claim in the token matches the issuer configured in the Key Manager Endpoints section. To obtain the `iss` value from the token, decode the JWT token using an offline decoder or local tool (such as command-line utilities, IDE extensions, or browser developer tools) and check the `iss` claim in the payload. **Do not paste production or sensitive tokens into public online decoders like jwt.io**, as this may expose sensitive information. If there is a difference between the `iss` value and your configured issuer, update the issuer in the Key Manager Endpoints section accordingly.🤖 Prompt for AI Agents
In en/docs/administer/key-managers/configure-azure-ad-key-manager.md around line
217, the guidance currently recommends using jwt.io without warning about
security risks of pasting production tokens; update this paragraph to: add a
clear warning not to paste production or sensitive tokens into public online JWT
decoders, recommend offline alternatives (e.g., CLI tools like
jwt-cli/jq/OpenSSL, IDE extensions, or browser devtools) as the preferred
methods for decoding tokens, and optionally note that if an online tool must be
used, strip or redact sensitive claims before pasting and use a non-production
token.
This PR was automatically generated by Claude AI.
Changes made:
https://<host>:9443/oauth2/scopeissclaim when troubleshooting Invalid Credentials Error, including reference to jwt.io as a decoding toolSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.