I have a client application (CA), an authentication server (AS) and a resource server (RS).
The resources on the RS must be accessed and usable only by authenticated users which have the authorization to do so.
The AS and RS share the same secret for signing and verifying JWT tokens.
Neither token expiration time nor revoking mechanisms are considered for this specific use case. Tokens are considered to have lifetime expiration and can not be revoked.
The CA tries to authenticate to the AS.
The AS sends a JWT token to the CA. The token is signed but not encrypted. Also, the token will have the token issuer identifier, the user ID and the user roles as claims.
The CA interacts with the RS API providing the token in the Authorization header.
If the RS verifies the signature of the token, can it be sure that the request comes from a user which has been successfully authenticated via the AS?
In other words, in this scenario is it possible to have unauthenticated users to provide valid JWT tokens?