Vertx jwt-auth read only

[איתי אדרי‎]

I am using vertx.jwt with read-only to validate a given request with a token to my service.

the public key I have is a .pem file starts with -----begin certificate--- and ends with ----end certificate----.

I am using the following options on when creating the provider:

JsonObject providerConfig = new JsonObject().put("public-key",Base64.getEncoder().encode(publicKey.getBytes()));

Where publicKey is a string containing the content of the .pem file.

Upon the creation of the JWTAuth:

JWTAuth provider = JWTAuth.create(vertx, providerConfig);

I receive java.security.spec.InvalidKeySpecException invalid key format 

...

at io.vertx.ext.auth.jwt.impl.JWT.<init>(JWT.java:108)

...

caused by sun.security.X509.X509Key.decode

How can I use the read only option for JWT validation?

[Paulo Lopes]

The JWT expects a public key not a certificate, second it expects that the key is base64 encoded, so it means that it should contain the data from your file excluding the first and last lines that read:

-----BEGIN PUBLIC KEY-----

and

-----END PUBLIC KEY-----

The content is already base64'ed so no need to double encode it as in your snippet.

Also it expects the key to be in the format:

RS256 also known as: SHA256withRSA (this is the format of keycloak) and can be also easily generated from GPG.

[Sergei Pestushko]

Hi, Paulo, 

I am doing the same thing Itai isdoing, but I still keep getting the java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: invalid key format

Basically what I am doing is: 

String publicCert = "MIFHT........"; // Contetns of .PEM file excluding --- START PUBLIC KEY & END KEY

JWTauthConfig authConf = new JWTauthConfig(publicCert);

AuthProvider jwtProvider = JWTAuth.create(vertx, authConf.getCertificate());

// Where the authConf.getCertificate returns the object created like this:

this.certificate = new JsonObject().put("public-key", base64Key.getBytes());

Would you be able to help with this please ? 

[Paulo Lopes]

Jwt works with keys not certificates you need to extract it from the certificate.

openssl x509 -in certificate.pem -pubkey -noout > public_key.pem