![[DEMO] JWT Validation Policy
Configuration
● Authorization header
● RSA 256 signing algorithm
● Public key static in policy
24](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-24-320.jpg)
![[DEMO] JWT Validation Policy
Configuration
● Do not validate client id
● Validate audience (aud)
○ Expected values one of
■ pl-lb.anypointdns.com
■ Api.patrykbandurski.com
■ test.patrykbandurski.com
● Expiration (exp) is mandatory
● Apply to all methods and resources
25](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-25-320.jpg)
![[DEMO] JWT Validation Policy
Generate JWS and place it in authorization header
400 Bad Request – no authorization header
401 Unauthorized – wrong token
26](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-26-320.jpg)
![[DEMO] JWT Validation Policy
27
[jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG
event:d87e0230-064c-11eb-a171-066db5e9ec56 Token was parsed successfully.
[jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG
event:d87e0230-064c-11eb-a171-066db5e9ec56 Ready to validate the signature of the token.
[jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG
event:d87e0230-064c-11eb-a171-066db5e9ec56 Token signature successfully validated.
[jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG
event:d87e0230-064c-11eb-a171-066db5e9ec56 Validating aud claim.
[jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG
event:d87e0230-064c-11eb-a171-066db5e9ec56 The server did not identify with the any of the
audiences '[aapi.patrykbandurski.com].'
DEBUG com.mulesoft.extension.policies.jwt on logging](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-27-320.jpg)
![[DEMO] JWT Validation Policy
28
● jwt.io
● Generate token
● Aud, iat, exp
● Public & private
key
● Remember! Do
not use online
tools to generate](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-28-320.jpg)
![[DEMO] JWT Validation Policy
29
● Required and optional
private claims
● Static comparison
● Complex expression with
DataWeave
Required claim email is not present in the JWT. Token will be rejected.](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-29-320.jpg)
![[DEMO] JWT Validation Policy
30
● Non mandatory claims.
○ Validate when claim name prasent
○ Can be complex – DataWeave – example
roles is an Array haveing at least one item.
Available values are USER, ADMIN or
CONTRIBUTOR
○ Refer to claim via vars.claimSet.[claim-
name]
In case of failed condition, this will be saved in the log file "Condition ... not
met"](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-30-320.jpg)
![[DEMO] JWT Validation Policy - JWKS
● JWKS service
● Standard which allows customer
to rated public keys
35](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-35-320.jpg)
![[DEMO] JWT Validation Policy - JWKS
● URL to JWKS
36](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-36-320.jpg)
![[DEMO] JWT Validation Policy - JWKS
{
"keys": [
{
"kty": "RSA",
"e": "AQAB",
"alg": "RS256",
"kid": "uniqueid",
"n": "…"
}
]
}
37
JSON Web Keys Set:](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-37-320.jpg)
![[DEMO] Generating JWT
43](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-43-320.jpg)
![[DEMO] Generating JWT
● Removed expected expiration claim
● 401 in return
44](https://image.slidesharecdn.com/warsawmulesoftmeetup8jwtdemystified-201019162757/85/MuleSoft-JWT-Demystified-44-320.jpg)
MuleSoft JWT Demystified
- 1. 06/10/2020 Warsaw MuleSoft Meetup Group JSON Web Token demystified
- 2. 2 ● Introductions & Community Updates ● Introduction to JWT ● JSON Validation Policy ● Consuming service with JWT validation policy ● Quiz & Lottery ● What’s next & Close Agenda
- 3. Introduction
- 5. 5 ● Subject Matter Expert at PwC Poland ● MuleSoft Ambassador ● MuleSoft Meetup Leader for Warsaw, Poland ● Working with MuleSoft products for over 8 years now ● One of Salesforce Trailblazers https://trailhead.salesforce.com/trailblazers/patryk-bandurski Organizer / Speaker Check out my integration blog https://ambassadorpatryk.com/blog
- 6. Share the event 6 ● Share the Meetup in your social media ● Use Hashtags #MuleSoftMeetup #WarsawMuleSoftMeetup Thanks
- 8. 8 MuleSoft CONNECT:Now MuleSoft CONNECT:Now is a virtual experience bringing you a full program of technical sessions and content, streamed online for free! Register for free: https://connect.mulesoft.com
- 9. 9 Developer Meetups at CONNECT:Now events Meet the MuleSoft Community! ● Hear technical use cases from customer and partner MuleSoft experts around the globe ● Live chat with MuleSoft Ambassadors! JOIN ONLINE FOR FREE: EMEA: October 8, 2020 AMER: October 13, 2020 APAC: October 20, 2020 Register: https://connect.mulesoft.com/
- 10. Check out the technical presentations below: Developer Meetup at CONNECT:Now EMEA ● Twitter ○ Felipe Ocadiz, MuleSoft Ambassador, IT Integration Engineer ○ How to become an Anypoint Studio ninja ● Saint-Gobain ○ Francis Edwards, MuleSoft Ambassador, Integration Analyst ○ Useful integration tools JOIN FOR FREE: October 8, 2020 (10:30am-11:15am BST) Register: https://connect.mulesoft.com/events/connect/emea
- 11. Check out the technical presentations below: Developer Meetup at CONNECT:Now Americas ● AT&T ○ Brad Ringer, Principal System Engineer ○ MuleSoft Runtime Fabric: The road to success ● MuleSoft Ambassadress ○ Alexandra Martinez, Sr. MuleSoft Developer, Bits in Glass ○ Reviewing a complex DataWeave transformation JOIN FOR FREE: October 13, 2020 (10:30am-11:15am PDT) Register: https://connect.mulesoft.com/events/connect/amer
- 12. Check out the technical presentations below: Developer Meetup at CONNECT:Now JAPAC ● Datacom ○ Mary Joy Sabal, Sr. Integration Developer ○ Using Maven Archetypes to create MuleSoft API Project Templates ● MuleSoft Ambassador ○ Sravan Lingam, Consultant, Virtusa ○ Create a virtual Tic-Tac-Toe game using Object Store v2 JOIN FOR FREE: October 20, 2020 (2:30pm-3:15pm AEDT) Register: https://connect.mulesoft.com/events/connect/japac
- 13. 13 Follow Mariana Lemus on LinkedIn
- 14. MuleSoft Ambassadors ● People to learn from ● Active in the MuleSoft Community ● Worth following ● 20 MuleSoft Ambassadors: https://developer.mules oft.com/dev/ambassado rs 14
- 15. ● MuleSoft Partner Calendar MuleSoft Partnership ● Free online tutored Development Fundamentals available now! ● Visit Partnership Calendar https://www.mulesoft.com/integration-partner/program/calendar ● Other interesting calendars: 15
- 16. Introduction JSON Web Token Demystyfied
- 17. JSON Web Token „JSON web token (JWT), pronounced "jot", is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. Again, JWT is a standard, meaning that all JWTs are tokens, but not all tokens are JWTs.” Auth0 Docs https://tools.ietf.org/html/rfc7515
- 18. JWS Structure ● JOSE Header ○ Algorithm used to sign ● Payload ○ Claims – statements about caller/user. We have registered claims, public claims and private claims. ● Signature ○ Signed encoded header and payload parts 18
- 19. Payload part of JWS 19 Claim property Claim name Description Example iss Issuer Issuer of the JWT Me sub Subject Subject of the JWT (the user) Bob aud Audience Recipient for which the JWT is intended https://api.ambassadorpatryk.co m nbf Not Before Time before which the JWT must not be accepted for processing. Unix timestamp. 1516239022 iat Issued At Time at which the JWT was issued; can be used to determine age of the JWT. Unix timestamp. 1516239022 id Id Unique identifier; can be used to prevent the JWT from being replayed (allows a token to be used only once) b32737dc-adb0-4faf-8e38- 7d0478f18a2e exp Expiration Time identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. Unix timestamp. 1516239022
- 20. Signature base64urlEncoded(Header) + „.” + base64urlEncoded(Payload) 20
- 22. JWT Validation Policy ● Supports ○ RS256, RS384, RS512 (RSA) ○ HS256, HS384, HS512 (HMAC) ● Supports registered claims and custom claims ● JWT Key ○ Static private value ○ Dynamicaly retrieved from JWKS ● Read more -> https://docs.mulesoft.com/api-manager/2.x/policy-mule4-jwt-validation 22
- 23. RSA256 with extra validation • Registered claims • Private claims (mandatory, not mandatory) DEMO Setup JWT validation policy
- 24. [DEMO] JWT Validation Policy Configuration ● Authorization header ● RSA 256 signing algorithm ● Public key static in policy 24
- 25. [DEMO] JWT Validation Policy Configuration ● Do not validate client id ● Validate audience (aud) ○ Expected values one of ■ pl-lb.anypointdns.com ■ Api.patrykbandurski.com ■ test.patrykbandurski.com ● Expiration (exp) is mandatory ● Apply to all methods and resources 25
- 26. [DEMO] JWT Validation Policy Generate JWS and place it in authorization header 400 Bad Request – no authorization header 401 Unauthorized – wrong token 26
- 27. [DEMO] JWT Validation Policy 27 [jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG event:d87e0230-064c-11eb-a171-066db5e9ec56 Token was parsed successfully. [jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG event:d87e0230-064c-11eb-a171-066db5e9ec56 Ready to validate the signature of the token. [jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG event:d87e0230-064c-11eb-a171-066db5e9ec56 Token signature successfully validated. [jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG event:d87e0230-064c-11eb-a171-066db5e9ec56 Validating aud claim. [jwt-validation-1111044-sfdc-jwt-xapi-main].1111044-client-id-enforcementDEBUG event:d87e0230-064c-11eb-a171-066db5e9ec56 The server did not identify with the any of the audiences '[aapi.patrykbandurski.com].' DEBUG com.mulesoft.extension.policies.jwt on logging
- 28. [DEMO] JWT Validation Policy 28 ● jwt.io ● Generate token ● Aud, iat, exp ● Public & private key ● Remember! Do not use online tools to generate
- 29. [DEMO] JWT Validation Policy 29 ● Required and optional private claims ● Static comparison ● Complex expression with DataWeave Required claim email is not present in the JWT. Token will be rejected.
- 30. [DEMO] JWT Validation Policy 30 ● Non mandatory claims. ○ Validate when claim name prasent ○ Can be complex – DataWeave – example roles is an Array haveing at least one item. Available values are USER, ADMIN or CONTRIBUTOR ○ Refer to claim via vars.claimSet.[claim- name] In case of failed condition, this will be saved in the log file "Condition ... not met"
- 31. JWKS (JSON Web Keys Set) ● Set of keys contains the public keys used to verify any JWT ● JWK (JSON Web Key) – JSON object representing a cryptographic key ● Rotation of the keys at ease ● Key retrieved dynamically 31
- 32. JWK { "kty": "RSA", "e": "AQAB", "alg": "RS256", "kid": "uniqueid", "n": "lgyuFifEOODgA4rZP2gQUunm_nM4G5a9aHoLkEosrMPuD4 LClPbke9nn0LUJ4H-M_3rX9- yXhjzhjrduUDcImVMBATN7UsYOxYOZvqUjRf72y1eNjIWMnLBCWB uQZrhqN73ttCOJLg28llI- 65XDfd6qeOlSlGWQD1YSGjX8cHDXoADXOpKrwPZy1ghkJMMtsvFx QNJd8hVvmzPlq-jefOXFOcsBjCB- QQkA3Lty0dScKPKfFQVooZxVhqU_r2wrSvviAdl8pN5yKmhcmT9S 9Ke-mfpJXOnYB9y3Z9xRb0RFQBhrDBLNEc1TDCeRX2RZ- A9pUJ0IbG-b-rFlQYjNOw" } 32
- 33. Working with JWKS ● Provide url to JWKS – publicly available ● 503 Service Unavailable– JWKS is not accessible ● 401 Unauthorized – signing error 33
- 34. RSA256 using JSON Web Keys Set DEMO Setup JWT validation policy
- 35. [DEMO] JWT Validation Policy - JWKS ● JWKS service ● Standard which allows customer to rated public keys 35
- 36. [DEMO] JWT Validation Policy - JWKS ● URL to JWKS 36
- 37. [DEMO] JWT Validation Policy - JWKS { "keys": [ { "kty": "RSA", "e": "AQAB", "alg": "RS256", "kid": "uniqueid", "n": "…" } ] } 37 JSON Web Keys Set:
- 38. Consume 3rd party service with JWT Validation Policy
- 39. Generating JWS in Mule ● No native support in MuleSoft ● Salesforce OAuth JWT authentication mechanism ● Custom code: ○ JAVA ■ JJWT library https://github.com/jwtk/jjwt ○ Ruby ■ ruby-jwt library https://github.com/jwt/ruby-jwt ● Mule Custom Component: ○ JWT Component Extension https://github.com/dyeeye/jwt-component
- 40. JJWT sample code JwtBuilder builder = Jwts.builder() // (1) .setIssuer(claims.getIssuer()) // (2) .setSubject(claims.getSubject()) .setAudience(claims.getAudience()) .setNotBefore(claims.getNotBefore()) .setIssuedAt(claims.getIssuedAt()) .setId(claims.getId()); String jws = builder .signWith(privKey, SignatureAlgorithm.valueOf(algorithm)) // (3) .compact(); // (4) 40
- 41. JWT Component ● Supports signing algorithms ○ RSA 256, 384 and 512 ○ HMAC 256, 384 and 512 ● Claims ○ Registered ○ Private ● Visual support in Anypoint Studio ● Reads keystore from classpath 41
- 42. Service secured with JWT Validation Policy RSA DEMO Consume service
- 44. [DEMO] Generating JWT ● Removed expected expiration claim ● 401 in return 44
- 45. Questions?
- 46. Quiz
- 47. Trivia Quiz ● Quiz parts: ○ Three warm-up questions (you won’t get point from them) ○ Five questions (for points) ● Remember! ○ The quicker you respond more point you earn ○ Only good answers count 47 Three winners of today’s quiz receives: Free voucher for MuleSoft online training and exam
- 48. Lottery ● How it works? ○ I call API that selects randomly three winners among checked-in attendees. ○ I will ask winners by Name & Surname for the email ● Remember! ○ Prize is sponsored by 48 Three winners of today’s lottery receives: Amazon Voucher for 50$
- 49. Congratulation ● Congratulation to all the winners ○ of the Quiz ○ of the lottery ● Remember to send your email address to the organizer via chat window! 49
- 50. Wrap up
- 51. Share your knowledge ● Become a speaker and share your knowledge with our community ● Submit your idea via this form: https://tinyurl.com/become-speaker via email patryk.bandurski@gmail.com or 51
- 52. 52 ● Share: ○ Tweet using the hashtag #MuleSoftMeetups ○ Invite your network to join: https://meetups.mulesoft.com/warsaw/ ● Feedback: ○ Fill out the survey feedback and suggest topics for upcoming events ○ Contact MuleSoft at meetups@mulesoft.com for ways to improve the program What’s next?
- 53. See you next time