microprofile-jwt-auth resources location

[Victor]

Hello,

I developed a small application using microprofile-jwt-auth recently, but I hit a hurdle.

Current verson of Payara only supports microprofile.jwt-auth 1.0, and that seems to require the publicKey.pem and payara-mp-jwt.properties files to reside in the root of the application classpath.

Can I define an alternate location somehow? I really don't want to package the files with the WAR application as it would forbid me to deploy the same artifact though my multiple environments.

Thanks,

Victor

[Fabio Turizo]

Hi Victor,

The location of the public key is configurable with the mp.jwt.verify.publickey.location configuration property as specified in the MP JWT 1.1 specifications. For the issuer claim, the mp.jwt.verify.issue configuration property will be used instead of the payara-mp.properties file. Payara Server 5.183 will be made compatible with MP 1.4 which comes with that release so you will have to wait until it is made available. I'm afraid that at the current release there's no other mechanism to configure these locations.

Regards,

Fabio.

[Arjan Tijms]

There's an example here, using a Payara 5.183 nightly, to demonstrate how setting the alternate location works:

https://github.com/javaee-samples/microprofile1.4-samples/blob/master/jwt-auth/basic-authentication/src/test/java/org/eclipse/microprofile14/jwtauth/basic/BasicAuthenticationAltLocationTest.java

[Victor]

Thanks!

I'll be waiting for the next release of Payara then.

[Victor]

Hi Fabio,

I got the newly released version of Payara Micro 5.183 and I was unsuccessful trying to make it work with the system parameters

My location (-Dmp.jwt.verify.publickey.location) is set to an https address that contains the plublic key in the JSON Web Key Set (JWKS) format.

My issuer  (-Dmp.jwt.verify.issuer) is set to the issuer of my token.

I always get 401 errors, and nothing appears on the logs.

I could make it work instead by using -Dmp.jwt.verify.publickey and passing the public key as parameter instead. That kind of defeats the purpose of having an endpoint providing the public key.

Can you help?

Thanks,

Victor

On Thursday, August 16, 2018 at 5:10:12 PM UTC+2, Fabio Turizo wrote:

[Ondro Mihályi]

Hi Victor,

The public key is obtained using URL.openStream as you can see here: https://github.com/payara/Payara/blob/8f4f49dc1a5e79b0ac4072432724e9c88f27838f/appserver/payara-appserver-modules/microprofile/jwt-auth/src/main/java/fish/payara/microprofile/jwtauth/eesecurity/SignedJWTIdentityStore.java#L188

If the URL you provide is correct and accessible, the public key from the remote location should be used as you expect. Maybe your URL is malformed? In that case Payara doesn't log anything and simply ignores the value of the "location" configuration.

If you specify both the key and the location, then the location is ignored.

Can you reproduce the same problem with the example application that Arjan pointed to? This one: https://github.com/javaee-samples/microprofile1.4-samples/blob/master/jwt-auth/basic-authentication/src/test/java/org/eclipse/microprofile14/jwtauth/basic/BasicAuthenticationAltLocationTest.java

Ondro

[Victor]

Hello Ondro,

After doing some research, I may have a proxy giving out an error when my backend application tries to access the public key location.

I'll try to take the proxy out of the equation.If it fails I'll try to reproduce the same problem using the application Arjan pointed to.

However, the behavior of failing silently deeply disturbs me. Is there a way for me to make Payara more verbose if there are any issues getting the key from the location specified?

Thanks,

Victor

[Ondro Mihályi]

You may submit a pull request to add a log message if the URL is malformed. Or raise an issue on github. But without a code change there's nothing to do. 

Dňa pi 7. 9. 2018, 10:25 Victor <victor.b...@gmail.com> napísal(a):

--
You received this message because you are subscribed to the Google Groups "Payara Forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to payara-forum...@googlegroups.com.
To view this discussion on the web, visit https://groups.google.com/d/msgid/payara-forum/07a570e2-1f0c-4374-94d6-c6dc4d6565cb%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.