jwt-http2

jwt-gRPC

The JWT is implemented according to RFC7519 using gRPC.

Core idea is to make fast and secure service to create and manage JWT-tokens and not store secure data into payload of tokens.

To create and validate tokens application using private and public RSA certificates. That is why you need public and private certificates. Private - needs to sign JWT, public needs to other services to validate it.

Environments

Main tools

Redis

Using to store secret data by token-uuid. Every token has his own UUID which is key in redis, and userId which is value for this key.

Consul

Store you configuration to Consul by versioning your configs with app. App has endpoint /watch on which Consul will send data to if you would change configs.

If you have app of version v1.0.1 so it will be waiting for changes of config with version v1.0.1.

Path is formed as:
/folder/version/file

Using ENV variables:
/CONSUL_KEY_FOLDER/CONSUL_KEY_VERSION/CONSUL_KEY_FILE

Example:
/jwt_auth/v1.0.0/config.yaml

Jaeger

Jaeger: open source, end-to-end distributed tracing Monitor and troubleshoot transactions in complex distributed systems. Fast and very comfortable to use.

Vault

Vault is a complex tool. In our situation we are using it to store Redis connection data and certificates.

The main reason to use it, that you can create tokens for others applications and apply policies to read only public certificate.

For exampple:

We have public and private certificates in folder crt. Paths will be /authentication/crt/public and /authentication/private.

We have application users which want to validate JWT tokens created by our application.

We need to follow next steps to allow to read public certificate from Vault:

1. Create policy to only read from /authentication/crt/public(user-policy.hcl) Example of user-policy.hcl:

path "authentication/data/crt/public" {
  capabilities = ["read"]
}

1. Write this policy to Vault

vault policy write user-policy /policies/user-policy.hcl

1. Create vault-token with this policy

vault token create -policy=user-policy

1. Give this new token to user-app

Now you can read data only from /authentication/crt/public.

Configuration

You can find default configuration in repository config.yaml

Consul

TTL using his own measurement system. You can pass s, m, h and d.

s - seconds
m - minutes
h - hours
d - days

Vault

By default we have Redis data and certificates in Vault.

Redis data(redis_config.json):

{
  "host": "localhost:6379",
  "password": ""
}

Certificates:

{
  "key": "certificate string"
}