Consumer authentication and authorization

The following Java example shows how to generate a token. You can use equivalent tools in other programming languages to generate a key pair.

1. Create a Maven project and add the following dependency:

   <dependency>
       <groupId>org.bitbucket.b_c</groupId>
       <artifactId>jose4j</artifactId>
       <version>0.7.0</version>
   </dependency>

2. Generate a token by using either a symmetric key or an asymmetric key. Choose the method that fits your requirements:

   Symmetric key

   Code example:

   package org.example;
   
   import java.io.UnsupportedEncodingException;
   import java.security.PrivateKey;
   
   import org.jose4j.base64url.Base64;
   import org.jose4j.json.JsonUtil;
   import org.jose4j.jwk.OctJwkGenerator;
   import org.jose4j.jwk.OctetSequenceJsonWebKey;
   import org.jose4j.jws.AlgorithmIdentifiers;
   import org.jose4j.jws.JsonWebSignature;
   import org.jose4j.jwt.JwtClaims;
   import org.jose4j.jwt.NumericDate;
   import org.jose4j.keys.HmacKey;
   import org.jose4j.lang.JoseException;
   import sun.lwawt.macosx.CSystemTray;
   
   public class Main {
       public static void main(String[] args) throws JoseException, UnsupportedEncodingException {
           // Use the preceding example.
           String privateKeyJson = "{\n"
                   + "    \"k\": \"VoBG-oyqVoyCr9G56ozmq8n_rlDDyYMQOd_DO4GOkEY\",\n"
                   + "    \"kty\": \"oct\",\n"
                   + "    \"alg\": \"HS256\",\n"
                   + "}";
           JwtClaims claims = new JwtClaims();
           claims.setGeneratedJwtId();
           claims.setIssuedAtToNow();
           // Set an expiration time that is less than 7 days.
           NumericDate date = NumericDate.now();
           date.addSeconds(120*60);
           claims.setExpirationTime(date);
           claims.setNotBeforeMinutesInThePast(1);
           // Add custom claims. All values must be of the String type.
           // Set the consumer identifier.
           claims.setClaim("uid", "11215ac069234abcb8944232b79ae711");
           JsonWebSignature jws = new JsonWebSignature();
           // Set the encryption algorithm.
           jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.HMAC_SHA256);
           jws.setKey(new HmacKey(Base64.decode(JsonUtil.parseJson(privateKeyJson).get("k").toString())));
           jws.setPayload(claims.toJson());
           String jwtResult = jws.getCompactSerialization();
           System.out.println("Generate Json Web token , result is \n " + jwtResult);
       }
   }

   The following list describes the key code settings:

   • privateKeyJson: The JWKS used when creating the consumer. You can record the JWKS during consumer creation, or retrieve it from the consumer's basic configuration page afterward.

   • Set the consumer identifier: claims.setClaim("uid", "11215ac069234abcb8944232b79ae711"). The console generates this identifier by default when the consumer is created, but you can modify it. You can also retrieve the consumer identifier from the consumer's basic configuration page afterward.

   • Set the encryption algorithm: jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.HMAC_SHA256). The encryption algorithm must match the one specified in the JWKS.

     Note

     The supported encryption algorithms are ES256, ES384, ES512, RS256, RS384, RS512, PS256, PS384, PS512, HS256, HS384, HS512, and EdDSA.

     When using symmetric encryption, you must decode the "k" value.

     jws.setKey(new HmacKey(Base64.decode(JsonUtil.parseJson(privateKeyJson).get("k").toString())));

   • Set an expiration time. The expiration time must be less than 7 days. For security, generate a new token after the current one expires.

     ...
         NumericDate date = NumericDate.now();
         date.addSeconds(120*60);
         claims.setExpirationTime(date);
         claims.setNotBeforeMinutesInThePast(1);
     ...

   • You can add custom claims to the PAYLOAD of the JWKS based on your business requirements.

   Asymmetric key

   Code example:

   package org.example;
   
   import java.security.PrivateKey;
   import org.jose4j.json.JsonUtil;
   import org.jose4j.jwk.RsaJsonWebKey;
   import org.jose4j.jws.AlgorithmIdentifiers;
   import org.jose4j.jws.JsonWebSignature;
   import org.jose4j.jwt.JwtClaims;
   import org.jose4j.jwt.NumericDate;
   import org.jose4j.lang.JoseException;
   
   public class Main {
       public static void main(String[] args) throws JoseException {
           // Example of a private key in JWK format.
           String privateKeyJson = "{\n" 
                   + "    \"kty\": \"RSA\",\n"
                   + "    \"n\": \"0vx7agoebGcQSuuPiLJXZptN9nndrQmbSEslsARk...\",\n"
                   + "    \"e\": \"AQAB\",\n"
                   + "    \"d\": \"X4cTteJY_gn4FYPsr85_N_dfjA29V...\"\n"
                   + "}";
           JwtClaims claims = new JwtClaims();
           claims.setGeneratedJwtId();
           claims.setIssuedAtToNow();
           NumericDate date = NumericDate.now();
           date.addSeconds(120*60);
           claims.setExpirationTime(date);
           claims.setNotBeforeMinutesInThePast(1);
           claims.setClaim("uid", "11215ac069234abcb8944232b79ae711");
           JsonWebSignature jws = new JsonWebSignature();
           jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
           PrivateKey privateKey = new RsaJsonWebKey(JsonUtil.parseJson(privateKeyJson)).getPrivateKey();
           jws.setKey(privateKey);
           jws.setPayload(claims.toJson());
           String jwtResult = jws.getCompactSerialization();
           System.out.println("Generated JSON Web Token result: \n" + jwtResult);
       }
   }

   The following list describes the key code settings:

   • Set the consumer identifier and expiration time, similar to the symmetric key example. The privateKeyJson must contain your asymmetric private key in JWK format.

     Set the encryption algorithm, such as jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256). This encryption algorithm must match the one in the JWKS.

     For an asymmetric encryption algorithm, you must use its private key to sign the token.

     ...
         jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.RSA_USING_SHA256);
         PrivateKey privateKey = new RsaJsonWebKey(JsonUtil.parseJson(privateKeyJson)).getPrivateKey();
         jws.setKey(privateKey);
     ...

   • You can add custom claims to the PAYLOAD of the JWKS based on your business requirements.