RE: JWT issue TomEE 9.1.2 micro-profile flavor

THALES GROUP LIMITED DISTRIBUTION to email recipients


Hello Zoltan,



I don't know why I have written Victor in my previous post ☹

Sorry about that.


Your point is that typ field is missing in my signed JWT header, right ?

I was believing that this one is not mandatory.
Looking at microprofile-jwt-auth-spec-2.0.pdf, typ is recommended but not required.

Anyway I will try and let you know.

Best Regards.

From: Tichov Zoltán <[email protected]>
Sent: jeudi 4 avril 2024 11:34
To: [email protected]
Subject: Re: JWT issue TomEE 9.1.2 micro-profile flavor


Hi Francois!

Try to generate the token with  "alg" : "RSA256" and "type" : "JWT".

Best regards:

Zoltán


2024. 04. 04. 11:18 keltezéssel, COURTAULT Francois írta:

THALES GROUP LIMITED DISTRIBUTION to email recipients



Hello Victor,



I use this library:



<dependencies>

    <dependency>

      <groupId>org.bitbucket.b_c</groupId>

      <artifactId>jose4j</artifactId>

      <version>0.9.6</version>

    </dependency>

  </dependencies>



to create the JWT.



Best Regards.



-----Original Message-----

From: Tichov Zoltán <[email protected]><mailto:[email protected]>

Sent: jeudi 4 avril 2024 11:06

To: [email protected]<mailto:[email protected]>

Subject: Re: JWT issue TomEE 9.1.2 micro-profile flavor



Hi Francois!



How did you generate the token?



Best regards





2024. 04. 04. 10:38 keltezéssel, COURTAULT Francois írta:

THALES GROUP LIMITED DISTRIBUTION to email recipients



Hello everyone,



I built  a war with a class  which extends Application and annotated

with @LoginConfig(authMethod = "MP-JWT") I have created a signed JWT

which is OK when I validated it (public key provided) using jwt.io web

site



I want to test this signed JWT with my war.

In this one, under META-INF, I have created a

microprofile-config.properties with the following entries

mp.jwt.verify.publickey=MIIBojANBgkqhkiG9w0BAQEFAAO...  (the same

public key that I have used to validate the signed JWT using jwt.io

web site) mp.jwt.verify.issuer=https://server.example.com



Then I run a curl with -H "Authorization: Bearer

eyJraWQiOiJhYmMtMTIzNDU2Nzg5MCIsImFsZyI6IlJTMzg0In0.ey ..." (the same signed JWT I used on jwt.io web site) I got this:



   *   at client side: ...HTTP Status 401 - Unauthorized ... Invalid or not parsable JWT

   *   at server side:

04-Apr-2024 10:14:31.255 WARNING [http-nio-8080-exec-5] org.apache.tomee.microprofile.jwt.MPJWTFilter$ValidateJSonWebToken.parse JWT processing failed. Additional details: [[17] Unable to process JOSE object (cause: org.jose4j.lang.InvalidKeyException: The given key (key is null) is not valid for SHA384withRSA): JsonWebSignature{"kid":"abc-1234567890","alg":"RS384"}-> eyJraWQiOiJhYmMtMTIzNDU2Nzg5MCIsImFsZyI6IlJTMzg0In0.ey...



What's wrong ?



Best Regards.








--
Tisztelt Címzett!







Üdvözlettel:
Tichov Zoltán

[cid:[email protected]]
Falcon-Soft Fejlesztő és Tanácsadó Kft.
H-1134 Budapest, Lehel u. 11.
Tel.: +36 (1) 350-4571
e-mail:[email protected]<mailto:[email protected]>
http://www.falconsoft.hu