Uncategorized

Get clarity about what JWT, JWS, JWK are and how to use them

JSON Web Token (JWT) are used in the network communication to pass information between parties. In particular they used to communicate with Identity Providers to exchange signed JWT also known as JWS for authorization tokens and then access tokens.

If it sounds confusing at first it is. And then there are more acronyms like JWA, JWKS etc. But don’t be frustrated. There are a couple of resources that can make you life easier as a developer.

I’ll focus in this post on Java language, but the information mention here is applicable to other languages too. You simply need to search for particular tools in that language or framework.

What is an encoded JWT?

If you need to be able to decode encoded JWT, than there is no other source then Auth0 web site to do just that

jwt.io

There you can decode a JWT or JWS to check that is has proper structure and content. Which is very helpful when you iterate to integrate with Identity Provider API.

I need to understand this in depth

The best source to learn about the JWT and the like is the The JWT Handbook by Sebastián E. Peyrott from Auth0 company. You also can download it for free, by providing them with your email and filling in a basic form here. This book provides very detailed explanation about JSON Web Token with lots of practical examples. Some of them we’ll use next.

How to generate private and public keys to be able to get a JSON Web Key (JWK)?

The JWT Handbook comes in handy since on the page 39 it exactly shows how to do it using RSA256 algorithm and Linux tools. In this case it is OpenSSL library. Since Windows does not have such a tool out of the box I suggest you to check Windows Subsystem for Linux 2 (WSL 2) that you can install on Windows 10 and higher within minutes (literally) and get Ubuntu, CentOS and other distributions running natively on Windows! Here come two guides on how to do it.

I followed the steps in the second bullet point and have my Ubuntu up and running locally

Use OpenSSL to generate private and public keys

Now, that Ubuntu is on Windows let’s generate private key and then use it to generate a public key

Private key generation

openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048

You end up with the text file in your file system with the key inside

test@xyz:~$ ls
private_key.pem

Public key generation

openssl rsa -pubout -in private_key.pem -out public_key.pem

amc@MINE-LAPTOP-130JJTQ6:~$ ls
private_key.pem  public_key.pem

Generating JWK

The steps below rely on the the tutorial about how to use Nimbus JOSE + JWT open-source library from connect2id company.

Now that you have these keys let’s say you already was able to read them in you Java code from a file so let’s jump into how you can covert them into JWK

import java.security.*;
import java.security.interfaces.*;
import java.util.*;

import com.nimbusds.jose.jwk.*;
import com.nimbusds.jose.jwk.gen.*;

// Public and private keys from a file. The method calls below are for example only
PublicKey publicK = getPublicKeyFromFile(path);
PrivateKey privateK = getPriavetKeyFromFile(path);

// Convert to JWK format
JWK jwk = new RSAKey.Builder((RSAPublicKey)publicK) 
    .privateKey((RSAPrivateKey)privateK) 
    .keyUse(KeyUse.SIGNATURE)
    .keyID(UUID.randomUUID().toString())
    .issueTime(new Date())
    .build();

// Output the private and public RSA JWK parameters
System.out.println(jwk);

In the end the output looks like below

{
  "kty" : "RSA",
  "kid" : "cc34c0a0-bd5a-4a3c-a50d-a2a7db7643df",
  "use" : "sig",
  "n"   : "pjdss8ZaDfEH6K6U7GeW2nxDqR4IP049fk1fK0lndimbMMVBdPv_hSpm8T8EtBDxrUdi1OHZfMhUixGaut-3nQ4GG9nM249oxhCtxqqNvEXrmQRGqczyLxuh-fKn9Fg--hS9UpazHpfVAFnB5aCfXoNhPuI8oByyFKMKaOVgHNqP5NBEqabiLftZD3W_lsFCPGuzr4Vp0YS7zS2hDYScC2oOMu4rGU1LcMZf39p3153Cq7bS2Xh6Y-vw5pwzFYZdjQxDn8x8BG3fJ6j8TGLXQsbKH1218_HcUJRvMwdpbUQG5nvA2GXVqLqdwp054Lzk9_B_f1lVrmOKuHjTNHq48w",
  "e"   : "AQAB",
  "d"   : "ksDmucdMJXkFGZxiomNHnroOZxe8AmDLDGO1vhs-POa5PZM7mtUPonxwjVmthmpbZzla-kg55OFfO7YcXhg-Hm2OWTKwm73_rLh3JavaHjvBqsVKuorX3V3RYkSro6HyYIzFJ1Ek7sLxbjDRcDOj4ievSX0oN9l-JZhaDYlPlci5uJsoqro_YrE0PRRWVhtGynd-_aWgQv1YzkfZuMD-hJtDi1Im2humOWxA4eZrFs9eG-whXcOvaSwO4sSGbS99ecQZHM2TcdXeAs1PvjVgQ_dKnZlGN3lTWoWfQP55Z7Tgt8Nf1q4ZAKd-NlMe-7iqCFfsnFwXjSiaOa2CRGZn-Q",
  "p"   : "4A5nU4ahEww7B65yuzmGeCUUi8ikWzv1C81pSyUKvKzu8CX41hp9J6oRaLGesKImYiuVQK47FhZ--wwfpRwHvSxtNU9qXb8ewo-BvadyO1eVrIk4tNV543QlSe7pQAoJGkxCia5rfznAE3InKF4JvIlchyqs0RQ8wx7lULqwnn0",
  "q"   : "ven83GM6SfrmO-TBHbjTk6JhP_3CMsIvmSdo4KrbQNvp4vHO3w1_0zJ3URkmkYGhz2tgPlfd7v1l2I6QkIh4Bumdj6FyFZEBpxjE4MpfdNVcNINvVj87cLyTRmIcaGxmfylY7QErP8GFA-k4UoH_eQmGKGK44TRzYj5hZYGWIC8",
  "dp"  : "lmmU_AG5SGxBhJqb8wxfNXDPJjf__i92BgJT2Vp4pskBbr5PGoyV0HbfUQVMnw977RONEurkR6O6gxZUeCclGt4kQlGZ-m0_XSWx13v9t9DIbheAtgVJ2mQyVDvK4m7aRYlEceFh0PsX8vYDS5o1txgPwb3oXkPTtrmbAGMUBpE",
  "dq"  : "mxRTU3QDyR2EnCv0Nl0TCF90oliJGAHR9HJmBe__EjuCBbwHfcT8OG3hWOv8vpzokQPRl5cQt3NckzX3fs6xlJN4Ai2Hh2zduKFVQ2p-AF2p6Yfahscjtq-GY9cB85NxLy2IXCC0PF--Sq9LOrTE9QV988SJy_yUrAjcZ5MmECk",
  "qi"  : "ldHXIrEmMZVaNwGzDF9WG8sHj2mOZmQpw9yrjLK9hAsmsNr5LTyqWAqJIYZSwPTYWhY4nu2O0EY9G9uYiqewXfCKw_UngrJt8Xwfq1Zruz0YY869zPN4GiE9-9rzdZB33RBw8kIOquY3MK74FMwCihYx_LiU2YTHkaoJ3ncvtvg"
}

Now, you can use that JWK as as Static JWK for integration with Identity Provider if they require one. Which I needed recently actually.

Quick decoding of JWT or JWS

If you need to be able to review the content of JWT or JWS then go no further then JWT Token website
For example, if you have the key below

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Then it will be decoded into

HEADER:ALGORITHM & TOKEN TYPE

{
  "alg": "HS256",
  "typ": "JWT"
}
PAYLOAD:DATA

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}
VERIFY SIGNATURE

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),

  your-256-bit-secret

) secret base64 encoded

Let’s it for today. I hope you find it useful.