Lacking support for "smallrye.jwt.sign.key-location" smallrye jwt private key location support.

[patoessy]

JWT creation failing on Quarkus 1.2.0 using new smallrye jwt generation utility
Smallrye added a new configuration property to load private key for encryption. But in quarkus, its not been loaded.

Expected behavior
Load the private key specified by smallrye.jwt.sign.key-location config and be able to generate a jwt token

Actual behavior
An exception is thrown: io.smallrye.jwt.build.JwtSignatureException: Inner JWT can not be created, 'smallrye.jwt.sign.key-location' is not set but the 'alg' header is: RS256.

To Reproduce
Steps to reproduce the behavior:
Create a quarkus app with JWT RBAC claims, then try to generate a token using smallrye/smallrye-jwt#153

For example below code:
String jwt = Jwt.claims()
.claim("username", Collections.singletonMap("key", "value"))
.expiresAt(new Date().getTime() + 3600)
.groups("CUSTOMER")
.issuedAt(new Date().getTime())
.upn("[email protected]")
.audience("using-jwt-rbac")
.preferredUserName(username)
.subject("auth-noma-hapa")
.issuer("https://patopato/ghsdfgdhjsdg")
.jws()
.header("typ", "JWT")
.signatureKeyId("try-that-ui")
.signatureAlgorithm(SignatureAlgorithm.RS256)
.innerSign()
.encrypt();
System.out.println("This can work ... "+ jwt);

Environment (please complete the following information):

• Output of uname -a or ver: Linux babanane 5.3.0-26-generic Merge our two divergent heads #28-Ubuntu SMP Wed Dec 18 05:37:46 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

• Output of java -version:
  openjdk version "11.0.5" 2019-10-15
  OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.5+10)
  Eclipse OpenJ9 VM AdoptOpenJDK (build openj9-0.17.0, JRE 11 Linux amd64-64-Bit Compressed References 20191016_358 (JIT enabled, AOT enabled)
  OpenJ9 - 77c1cf708
  OMR - 20db4fbc
  JCL - 2a7af5674b based on jdk-11.0.5+10)

• Quarkus version : 1.2.0.Final

[sberyozkin]

@patoessy thanks for giving it a try. Quick note, iat claim is set to the current time by default so unless you need to set something different you can omit it. Same for the typ header (JWT is default), and signatureAlgorithm (default is RS256).

Do you set this property in application.properties ? Hmm...In the smallrye-jwt tests I provide a test configuration source. Need to think...

[sberyozkin]

For now, if you omit a signatureAlgorithm setter then it will work for innerSign() as you will end up with the none-signed inner JWT

[patoessy]

I needed to give everything a 1st time try

…

On Sat, Jan 25, 2020, 01:21 sberyozkin ***@***.***> wrote: @patoessy <https://github.com/patoessy> thanks for giving it a try. Quick note, iat claim is set to the current time by default so unless you need to set something different you can omit it. Same for the typ header (JWT is default). Do you set this property in application.properties ? Hmm...In the smallrye-jwt tests I provide a test configuration source. Need to think... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#6781?email_source=notifications&email_token=AG3RIRREPUWK3CYV7AK4673Q7NSV7A5CNFSM4KLMGE42YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEJ4IVOI#issuecomment-578325177>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AG3RIRVDUE6GCX7X7NRZAHDQ7NSV7ANCNFSM4KLMGE4Q> .

[patoessy]

@patoessy thanks for giving it a try. Quick note, iat claim is set to the current time by default so unless you need to set something different you can omit it. Same for the typ header (JWT is default), and signatureAlgorithm (default is RS256).

Do you set this property in application.properties ? Hmm...In the smallrye-jwt tests I provide a test configuration source. Need to think...

Make it uniform by prefixing with quarkus- something like: [quarkus-smallrye.jwt.sign.key-location]=META-INF/resources/privateKey.pem
I'm novice but in near future I'd provide pull requests. Thanks

[sberyozkin]

@patoessy thanks, but these are the properties which are meant to be recognized outside of Quarkus. Though having quarkus specific equivalents would make sense for all the smallrye-specific properties...

[sberyozkin]

@patoessy I have opened #6825 which, once merged, will close this issue. It uses a no-argument sign method which innerSign() delegates to. I've also confirmed locally that if I try innerSign() and comment out smallrye.jwt.sign.key-location then the error you reported will be indeed reported.
May be there was a typo in the property name, can you check please ? You may also want to try it against the Quarkus master as some major class loading changes have gone in, and it may have fixed the issue you are seeing...Finally, if nothing works then please create a reproducer (and reopen this issue if it will be closed). thanks

[patoessy]

Hello @sberyozkin , today it worked. I don't know how. But I recently discoved I was using 1.2.0.RC1 which hard the fuature already merged. Lemme test with encrypting the JWT token. Thanks. I have looked at #6825 and its really impressive.

[patoessy]

Guide me on how to update the documentation maybe I can try and contribute on that too.

[sberyozkin]

@patoessy Hi, thanks for already trying this API, and no problems, it is good to have it checked as part of the Quarkus build anyway.
Re the docs, right now it is in the design verification phase, I'm doing some more fixes in the smalrye-jwt library, we may also prepare a submission around it, so I'd like it to be as clean as possible before documenting it for Quarkus users. I can prepare some initial doc for 1.3.0 after another smalrye-jwt update and will CC you to review so that you could follow up with the improvements etc. Cheers

[patoessy]

Cheer @sberyozkin. Thanks

[sberyozkin]

@patoessy re the documentation in general, the current smallrye-jwt guide is here.