Closed jfslin closed 3 weeks ago
@jfslin You need to use Maven 3.9.2 at the moment as something got broken in Maven 3.9.3+ and this jar is part of the MP JWT release, it will require a new release of the spec to get around it somehow.
So, can you build the latest source with Maven 3.9.2, and do
smallrye.jwt.verify.secretkey = ew0KICAia3R5IjogIm9jdCIsDQogICJraWQiOiAiU2I2bWw4QmM3c1REUXcvIiwNCiAgImsiOiAiY0RFelVHWkVaRU16YW0xS1VIQk5NRkZVTldSNkwzcHdkSFJTUldKSmVsSjFaRTU2TXpSSmJFaEVaVXRyVnk5TFpqSmtWR2hpYlZKYVVWaFFVM0l2ZURkWVUzQnZOMkZqU21OeGJtZGhibUZSZWpkU1FURm5QVDA9IiwNCiAgImFsZyI6ICJIUzI1NiINCn0
smallrye.jwt.verify.algorithm = HS256
?
@jfslin The only other inline option for the secret key is:
smallrye.jwt.verify.secretkey = {jwk json}
smallrye.jwt.verify.algorithm = HS256
But I've no idea how to correctly set JSON in application.properties.
So, let's just focus on one of these 2 cases.
The tests I added yesterday confirm it must work.
@sberyozkin I have switched to Maven 3.9.2 but seem to not be able to generate the proper files. It now builds properly but it does not produce a jar file at either C:\github\smallrye-jwt\testsuite\tck\target
or C:\github\smallrye-jwt\release\target
or C:\Users\user\.m2\repository\io\smallrye\smallrye-jwt-release\4.5.4-SNAPSHOT
. Is there another setting I need to clear to avoid Building Empty Release Project to Avoid Maven Bug 4.5.4-SNAPSHOT
or JAR will be empty - no content was marked for inclusion!
[INFO] --- jar:3.4.2:jar (default-jar) @ smallrye-jwt-tck ---
[WARNING] JAR will be empty - no content was marked for inclusion!
[INFO] Building jar: C:\github\smallrye-jwt\testsuite\tck\target\smallrye-jwt-tck-4.5.4-SNAPSHOT.jar
[INFO]
[INFO] --- source:3.3.1:jar-no-fork (attach-sources) @ smallrye-jwt-tck ---
[INFO] No sources in project. Archive not created.
[INFO]
[INFO] --- install:3.1.2:install (default-install) @ smallrye-jwt-tck ---
[INFO] Skipping artifact installation
[INFO]
[INFO] ------------------< io.smallrye:smallrye-jwt-release >------------------
[INFO] Building Empty Release Project to Avoid Maven Bug 4.5.4-SNAPSHOT [12/12]
[INFO] from release\pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- clean:3.4.0:clean (default-clean) @ smallrye-jwt-release ---
[INFO] Deleting C:\github\smallrye-jwt\release\target
[INFO]
[INFO] --- buildnumber:3.2.0:create (get-scm-revision) @ smallrye-jwt-release ---
[INFO]
[INFO] --- formatter:2.22.0:format (format-sources) @ smallrye-jwt-release ---
[INFO]
[INFO] --- impsort:1.9.0:sort (sort-imports) @ smallrye-jwt-release ---
[INFO] Processed 0 files in 00:00.000 (Already Sorted: 0, Needed Sorting: 0)
[INFO]
[INFO] --- compiler:3.13.0:compile (default-compile) @ smallrye-jwt-release ---
[INFO] No sources to compile
[INFO]
[INFO] --- source:3.3.1:jar-no-fork (attach-sources) @ smallrye-jwt-release ---
[INFO]
[INFO] --- install:3.1.2:install (default-install) @ smallrye-jwt-release ---
[INFO] Installing C:\github\smallrye-jwt\release\pom.xml to C:\Users\user\.m2\repository\io\smallrye\smallrye-jwt-release\4.5.4-SNAPSHOT\smallrye-jwt-release-4.5.4-SNAPSHOT.pom
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for SmallRye: MicroProfile JWT Parent 4.5.4-SNAPSHOT:
[INFO]
[INFO] SmallRye: MicroProfile JWT Parent .................. SUCCESS [ 7.560 s]
[INFO] SmallRye: MicroProfile JWT - Implementation Parent . SUCCESS [ 1.178 s]
[INFO] SmallRye: MicroProfile JWT Implementation Common ... SUCCESS [ 5.798 s]
[INFO] SmallRye: MicroProfile JWT Build Implementation .... SUCCESS [ 7.111 s]
[INFO] SmallRye: MicroProfile JWT Implementation .......... SUCCESS [ 17.102 s]
[INFO] SmallRye: MicroProfile JWT JAX-RS Implementation ... SUCCESS [ 1.600 s]
[INFO] SmallRye: MicroProfile JWT HTTP Mechanism Implementation SUCCESS [ 0.912 s]
[INFO] SmallRye: MicroProfile JWT CDI Extension Implementation SUCCESS [ 0.456 s]
[INFO] SmallRye: MicroProfile JWT - Testsuite Parent ...... SUCCESS [ 0.015 s]
[INFO] SmallRye: MicroProfile JWT Basic Testsuite ......... SUCCESS [ 8.454 s]
[INFO] SmallRye: MicroProfile JWT TCK ..................... SUCCESS [01:01 min]
[INFO] Empty Release Project to Avoid Maven Bug ........... SUCCESS [ 0.047 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 01:52 min
[INFO] Finished at: 2024-08-18T14:02:20-04:00
[INFO] ------------------------------------------------------------------------
I agree with you, I think the smallrye.jwt.verify.secretkey = BASE64URL
makes more sense then having to parse JSON in the application.property
, and think this is a good way to go. Especially since most people using this argument would need to do the BASE64URL conversion for other parts of the JSON object anyway.
@jfslin Now that you have built it, use 4.5.4-SNAPSHOT
smallrye jwt dependency...
@jfslin I've done a quick test with your k
and both raw JSON and Base64 encoded one work:
diff --git a/testsuite/basic/src/test/java/io/smallrye/jwt/auth/principal/KeyLocationResolverTest.java b/testsuite/basic/src/test/java/io/smallrye/jwt/auth/principal/KeyLocationResolverTest.java
index 23c5bfe..728af04 100644
--- a/testsuite/basic/src/test/java/io/smallrye/jwt/auth/principal/KeyLocationResolverTest.java
+++ b/testsuite/basic/src/test/java/io/smallrye/jwt/auth/principal/KeyLocationResolverTest.java
@@ -199,7 +199,7 @@ class KeyLocationResolverTest {
JWTAuthContextInfoProvider provider = JWTAuthContextInfoProvider
.create("{\n"
+ " \"kty\":\"oct\",\n"
- + " \"k\":\"Fdh9u8rINxfivbrianbbVT1u232VQBZYKx1HGAGPt2I\"\n"
+ + " \"k\":\"cDEzUGZEZEMzam1KUHBNMFFUNWR6L3pwdHRSRWJJelJ1ZE56MzRJbEhEZUtrVy9LZjJkVGhibVJaUVhQU3IveDdYU3BvN2FjSmNxbmdhbmFRejdSQTFnPT0=\"\n"
+ " }",
null,
true,
@@ -217,7 +217,7 @@ class KeyLocationResolverTest {
String jwtString = Jwt.issuer("https://server.example.com").upn("Alice").sign("secretKey.jwk");
byte[] bytes = ("{\n"
+ " \"kty\":\"oct\",\n"
- + " \"k\":\"Fdh9u8rINxfivbrianbbVT1u232VQBZYKx1HGAGPt2I\"\n"
+ + " \"k\":\"cDEzUGZEZEMzam1KUHBNMFFUNWR6L3pwdHRSRWJJelJ1ZE56MzRJbEhEZUtrVy9LZjJkVGhibVJaUVhQU3IveDdYU3BvN2FjSmNxbmdhbmFRejdSQTFnPT0=\"\n"
+ " }").getBytes(StandardCharsets.UTF_8);
JWTAuthContextInfoProvider provider = JWTAuthContextInfoProvider
.create(Base64.getUrlEncoder().withoutPadding().encodeToString(bytes),
diff --git a/testsuite/basic/src/test/resources/secretKey.jwk b/testsuite/basic/src/test/resources/secretKey.jwk
index 96c6aa4..b9a8909 100644
--- a/testsuite/basic/src/test/resources/secretKey.jwk
+++ b/testsuite/basic/src/test/resources/secretKey.jwk
@@ -1,4 +1,4 @@
{
"kty":"oct",
- "k":"Fdh9u8rINxfivbrianbbVT1u232VQBZYKx1HGAGPt2I"
- }
\ No newline at end of file
+ "k":"cDEzUGZEZEMzam1KUHBNMFFUNWR6L3pwdHRSRWJJelJ1ZE56MzRJbEhEZUtrVy9LZjJkVGhibVJaUVhQU3IveDdYU3BvN2FjSmNxbmdhbmFRejdSQTFnPT0="
+ }
So let me close this issue. I'll need to fix a couple of other issues and then I'll release 4.5.4, hopefully this week
@sberyozkin sorry for the very novice questions, but I've gotten it included now.
A quick followup. Using
smallrye.jwt.verify.secretkey = ew0KICAia3R5IjogIm9jdCIsDQogICJraWQiOiAiU2I2bWw4QmM3c1REUXcvIiwNCiAgImsiOiAiY0RFelVHWkVaRU16YW0xS1VIQk5NRkZVTldSNkwzcHdkSFJTUldKSmVsSjFaRTU2TXpSSmJFaEVaVXRyVnk5TFpqSmtWR2hpYlZKYVVWaFFVM0l2ZURkWVUzQnZOMkZqU21OeGJtZGhibUZSZWpkU1FURm5QVDA9IiwNCiAgImFsZyI6ICJIUzI1NiINCn0
smallrye.jwt.verify.algorithm = HS256
I still get stuck at
d953-f812-49c2-b503-5bc5d2f290a8-5: jakarta.enterprise.inject.spi.DeploymentException: SRJWT02000: HMAC verification algorithms are not supported when the 'mp.jwt.verify.publickey.location' property is set, use 'smallrye.jwt.verify.key.location' instead
I am not sure if I should be doing this, but bypassing the mpJwtPublicKeyAlgorithm.isPresent()
check in JWTAuthContextInfoProvider:842
with the following
smallrye.jwt.verify.secretkey = ew0KICAia3R5IjogIm9jdCIsDQogICJraWQiOiAiU2I2bWw4QmM3c1REUXcvIiwNCiAgImsiOiAiY0RFelVHWkVaRU16YW0xS1VIQk5NRkZVTldSNkwzcHdkSFJTUldKSmVsSjFaRTU2TXpSSmJFaEVaVXRyVnk5TFpqSmtWR2hpYlZKYVVWaFFVM0l2ZURkWVUzQnZOMkZqU21OeGJtZGhibUZSZWpkU1FURm5QVDA9IiwNCiAgImFsZyI6ICJIUzI1NiINCn0
smallrye.jwt.verify.algorithm = HS256
mp.jwt.verify.publickey.algorithm = HS256
now works. I'm good to go now. Thank you so much.
I'll keep an eye out for the official 4.5.4 release.
@jfslin Np at all
smallrye.jwt.verify.secretkey = ew0KICAia3R5IjogIm9jdCIsDQogICJraWQiOiAiU2I2bWw4QmM3c1REUXcvIiwNCiAgImsiOiAiY0RFelVHWkVaRU16YW0xS1VIQk5NRkZVTldSNkwzcHdkSFJTUldKSmVsSjFaRTU2TXpSSmJFaEVaVXRyVnk5TFpqSmtWR2hpYlZKYVVWaFFVM0l2ZURkWVUzQnZOMkZqU21OeGJtZGhibUZSZWpkU1FURm5QVDA9IiwNCiAgImFsZyI6ICJIUzI1NiINCn0
smallrye.jwt.verify.algorithm = HS256
mp.jwt.verify.publickey.algorithm = HS256
mp.jwt.verify.publickey.algorithm = HS256
must not be required, I'll have a quick look a bit later, but we definitely don't want users to use a property for referring to the public key algorithms to set a symmetric one
@jfslin FYI, #819, thanks for early testing...
Following up to https://github.com/quarkusio/quarkus/discussions/42550 and https://github.com/smallrye/smallrye-jwt/issues/814 . Consolidating all the test cases here:
Defining the variables...
secretKey.jwk
contains ak
that is BASE64 secret key, as follows:defining a
jwk_base64
that is the entiresecretKey.jwk
file converted into a BASE64URL string, that is:there also exist a file
secretKey_url.jwk
that contains only the content ofjwk_base64
Now for the 2 successful use cases: comes from using the JWKs as files in either JSON or BASE64URL format:
and
Unsuccessful cases include different ways of using the symmetric key inline:
leading to a
error id: e4239d1a-0464-436e-b22b-e8c82e11e432-5: jakarta.enterprise.inject.spi.DeploymentException: SRJWT02000: HMAC verification algorithms are not supported when the 'mp.jwt.verify.publickey.location' property is set, use 'smallrye.jwt.verify.key.location' instead
error, which is odd because I don't havesmallrye.jwt.verify.key.location
set in this caseThe following cases all lead to the same error. If I use the BASE64 JWT:
Or using
k
:Or using the JWT file
Or using the BASE file
all leads to a
Authentication failed: io.smallrye.jwt.auth.principal.ParseException: SRJWT07000: Failed to verify a token
andorg.jose4j.lang.UnresolvableKeyException: SRJWT07004: Failed to load a key from the key content while resolving
error.As a sidenote, I pulled 64becff to test https://github.com/smallrye/smallrye-jwt/issues/814 and tried to build it locally, but wasn't able to build it. I get this error during
mvn clean install -X
:Trying to use this file: https://github.com/eclipse/microprofile-jwt-auth/blob/main/tck/src/test/resources/suites/tck-base-suite.xml and saving it at a few different locations under
testsuites\tck-suite\suites\
doesn't seem to field anything helpful.