Authorization

Describes the available authorization methods

Policy Users

Protegrity Policy roles defines the unique data access privileges for every member. The Protegrity Lambda protects the data with the username sent in either the JWT-formatted authorization header or the request body.

The lambda behavior can be set in the Lambda environment variables as described in Protect Lambda Configuration

Authorization/allow_assume_user	0	1
Empty	User from the request body. / (Throw an error).	User from the request body.
JWT	User from JWT payload	User from request body. If not found user from JWT payload.

JWT Verification

To ensure the integrity of the user, the lambda protect can verify the JWT.

From your AWS console, navigate to lambda and select the following Lambda: Protegrity_Protect_RESTAPI_<STACK_NAME>
Scroll down to the Environment variables section, select Edit to replace the entries.

Parameter	Value	Notes
authorization	JWT
jwt_verify	1
jwt_secret_base64	Secret in base64 encoding. For example, the value of the public key is as follows. `-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4fkg/JYyN3Skr6RYLiAd/Yhl0 2TE3/HzHSNPnCaRdUakGp9og7oXBMcoadFDjnoSq1sz+gUHnpoO7s2fwkD5Q4OnC BGD3oKP2A4PlOOWD2B2cVmMqX/vf1nAA/343496jsbfgkh1Q7LTzR0IXfdii0o1U CbvrVCuaBoyiv4TxWQIDAQAB -----END PUBLIC KEY-----` This public key will be stored as follows. `LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tL S0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUV VBQTRHTkFEQ0JpUUtCZ1FDNGZrZy9KWXl OM1NrcjZSWUxpQWQvWWhsMAoyVEUzL0h6 SFNOUG5DYVJkVWFrR3A5b2c3b1hCTWNvY WRGRGpub1NxMXN6K2dVSG5wb083czJmd2 tENVE0T25DCkJHRDNvS1AyQTRQbE9PV0Q yQjJjVm1NcVgvdmYxbkFBLzM0MzQ5Nmpz YmZna2gxUTdMVHpSMElYZmRpaTBvMVUKQ 2J2clZDdWFCb3lpdjRUeFdRSURBUUFCCi 0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQ==`	The secret must be in base64. We recommend using RSA public certificates, it is not recommended to keep Hash (symmetric) secrets in the clear.

Parameter

Value

Notes

authorization

JWT

jwt_verify

jwt_secret_base64

Secret in base64 encoding. For example, the value of the public key is as follows.

This public key will be stored as follows.

LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tL
S0KTUlHZk1BMEdDU3FHU0liM0RRRUJBUV
VBQTRHTkFEQ0JpUUtCZ1FDNGZrZy9KWXl
OM1NrcjZSWUxpQWQvWWhsMAoyVEUzL0h6
SFNOUG5DYVJkVWFrR3A5b2c3b1hCTWNvY
WRGRGpub1NxMXN6K2dVSG5wb083czJmd2
tENVE0T25DCkJHRDNvS1AyQTRQbE9PV0Q
yQjJjVm1NcVgvdmYxbkFBLzM0MzQ5Nmpz
YmZna2gxUTdMVHpSMElYZmRpaTBvMVUKQ
2J2clZDdWFCb3lpdjRUeFdRSURBUUFCCi
0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQ==

The secret must be in base64. We recommend using RSA public certificates, it is not recommended to keep Hash (symmetric) secrets in the clear.

Feedback

Was this page helpful?

Last modified : January 21, 2026