Storing Public Keys for Data Subject Authentication

OneTrust supports allowing consent receipts to be created only when the data subject identity has been authenticated, such as by logging in to a site or application. In this circumstance, OneTrust supports sending an additional data subject specific authorization token as a JWT passed in the header of the request, which is signed with a private key or secret. In addition, the corresponding public key will need to be provided to OneTrust to enable validation for the request before issuing the receipt. By generating and sending the JWT, which also includes the data subject identifier, the application demonstrates that the data subject identity is authentic.

In order for OneTrust to validate requests, Public Keys Settings allow users to select whether to store the public key sent in the authorization token in the application or to store a JSON Web Key Sets (JWKS) URL to verify JWT keys.

Storing Public Keys

You can select to store the public key sent in the authorization token in the application. If using this method, you can add public keys using the Public Keys screen in Global Settings.

Note:

For more information on the Public Keys screen in Global Settings, see Universal Consent & Preference Management Settings. You can set up a Web Form Collection Point to require authentication. For more information, see Collection Points with Data Subject Authentication.

To add a Public Key

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Consent > Public Keys. The Public Keys screen appears.

  3. Click the Add Public Key button. The Add Public Key modal appears. Complete the fields, as necessary.



    Field
    Description
    Name

    Enter a name to identify the public key.

    Public Key

    Enter the public key that the authorization will be verified against. Up to 999 characters are supported in this field.

    Note:

    The public key must be provided in one of the supported base64 algorithms listed in the Supported Algorithms field.

    Supported Algorithms

    Select the supported encryption algorithm for the public key. The following options are supported:

    • HS256

    • HS384

    • HS512

    • RS256

    • RS384

    • RS512

    • ES256

    • ES384

    • ES512

    Note:

    Public keys should be in the Privacy-Enhanced Mail (PEM) format for all the algorithms above except for HS256, HS384, and HS512.

    Key ID

    Enter a key ID to be used for verification purposes. This field is optional if you are only using one key or if you are using the default key.

  4. Click the Save button.

To set a new default public key

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Consent > Public Keys. The Public Keys screen appears.



  3. Click the Context Menu icon corresponding to the public key that you want to set as default.

  4. On the Context menu, select Set as default. The Set as default modal appears.



  5. Click the Confirm button. The selected public key is now set as the default.

To delete a public key

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Consent > Public Keys. The Public Keys screen appears.

  3. Click the Context Menu icon corresponding to the public key that you want to delete.

  4. On the Context menu, select Delete. The Delete Public Key modal appears.



  5. Click the Delete button.

Storing a JWKS URL

Alternatively, you can select to use JSON Web Key Sets to verify JWT keys when requiring data subject authentication on Collection Points or when using cross-device consent for Cookie Consent. If using this method, you can add the JWKS URL using the Public Keys screen in Global Settings.

To add a JWKS URL

  1. Click the gear icon in the upper right-hand corner to access Global Settings.

  2. On the Global Settings menu, select Consent > Public Keys. The Public Keys screen appears.

  3. Enable the Enable JWKS URL Storage setting. The JSON Web Key Sets field appears.



  4. Click the Edit button and enter a JWKS URL from which public keys will be fetched.

  5. Click the Submit button. A confirmation message will appear if the JWKS URL is successfully validated.