Error creating JWT Token

[Bhushan Nagaraj]

I am following the documentation as provided in https://developer.atlassian.com/static/connect/docs/concepts/understanding-jwt.html#create to create a new JWT token.

Below is a snippet of my code

JwtJsonBuilder jwtBuilder = new JsonSmartJwtJsonBuilder()
.issuedAt(issuedAt)
.expirationTime(expiresAt)
.issuer(key);

CanonicalHttpUriRequest canonical = new CanonicalHttpUriRequest(method, apiPath, contextPath, new HashMap());
JwtClaimsBuilder.appendHttpRequestClaims(jwtBuilder, canonical);
JwtWriterFactory jwtWriterFactory = new NimbusJwtWriterFactory();
def jwtbuilt = jwtBuilder.build();
String jwtToken = jwtWriterFactory.macSigningWriter(SigningAlgorithm.HS256, sharedSecret).jsonToJwt(jwtbuilt);
String apiUrl = baseUrl + apiPath + "?jwt=" + jwtToken;
return apiUrl;

However, I get the error Caused by NoSuchMethodError: com.nimbusds.jose.crypto.MACSigner.<init>(Ljava/lang/String;)V 

I noticed that the com.nimbusds.jose.crypto.MacSigner requires a byte[] array in it's constructor while the NimbusJwtWriterFactory in com.atlassian.jwt is passing a String. Any help?

Cheers

Bhushan

[Peter Brownlow]

Hi Bhushan,

What version of nimbus-jose-jwt are you using? The version that I'm running (2.16) has both MACSigner(byte[]) and MACSigner(String) constructors.

-Peter

[Bhushan Nagaraj]

Hi Peter,

I am using Version 2.9 of nimbus-jose-jwt.

Thank you

Bhushan

[Bhushan Nagaraj]

I was able to resolve this issue. Somewhere in my app config, it was including nimbus-jose-jwt 2.10 which does not have th String constructor. However, I am now getting "Unauthorized" message.

Failure during JWT authentication: 

com.atlassian.jwt.exception.JwtInvalidClaimException: Expecting claim 'qsh' to have value '85a1234698fa74fb9e2d934c5a609d482e779c743f52afe14efa537c7a74a446' but instead it has the value '39bcf6b2c597d72bf8bcdb3aecc8214e44ebbca9bada4bb086543aa0e4bb871e'

What am I missing?

Thank you

Bhushan

On Wednesday, 9 July 2014 10:40:23 UTC+10, Peter Brownlow wrote:

[Peter Brownlow]

Hi Bhushan,

Can you test your generated URLs on https://jwt-decoder.herokuapp.com/jwt/decode ? It is very useful and quick.

If after that you're still stuck then please post some example inputs to your token creation here (target url, shared secret, unencoded JWT claims).

-Peter

[Ky Pham]

I have similar issue with "Expecting claim 'qhs' to have ..."

The reason in my case is that somehow this parameter "&_=1442082431260" is appended to the url. This change the canonical request, and hence change the hash. 

http://localhost:1990/confluence/rest/api/content/1015815/history/1/macro/id/825a492c-ba8e-48ee-ab23-c5b57b4bcfc5?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJxc2giOiI1NTgzMzNkM2FkMWQyODAzOGM5ZjE5YmQ1MjlmOTAzYzZlZmFiYThhZjQ1YThiZTcwZTgxYzZlNjE1MzY1NTk3IiwiaXNzIjoiY29tLmF0bGFzc2lhbi5jb25uZWN0LnNxbHJ1bm5lciIsImV4cCI6MTQ0MjA4MjA3NSwiaWF0IjoxNDQyMDgxODk1fQ.UZD4Cx46GEXXMVLQUJyvIJdApmgjQPqun1hdsnJQ3Z4&_=1442082431260

Do you have some idea to fix that?

Thanks,

Ky

[Peter Brownlow]

Hi Ky,

You need to add this extra parameter to the URL before signing, or prevent it from being added. I'm guessing that a framework or library that you're using is automatically adding it.

-Peter

[Boris Jockov]

Hi Peter.

Could someone update the docs and add the required version of the nimbus-jwt for the example to work?

It's not immediately apparent that 2.16 is the right version. 

Boris.

[Peter Brownlow]

I have created this ticket to track this request:

https://ecosystem.atlassian.net/browse/AC-1765