JWT Authentication for API Gateway #6769

ChamodDamitha · 2019-08-03T14:19:45Z

Enable API authentication support using JWT tokens.

harsha89 · 2019-08-03T18:29:17Z

...gateway/src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/jwt/JWTValidator.java

+        JSONObject payload = null;
+        boolean isVerified = false;
+
+        String tokenSignature = splitToken[2];


possible array index out of bounds if someone sends a invalid jwt?

Invalid token split length is handled in the OAuthAuthenticator before hitting this code

harsha89 · 2019-08-03T18:32:42Z

...gateway/src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/jwt/JWTValidator.java

+        String signatureAlgorithm;
+        JSONObject header;
+        try {
+            header = new JSONObject(new String(Base64.getUrlDecoder().decode(splitToken[0])));


seems we do url decode? Can there be any other decoding methods?

In the Key manager, we do URL encode. That's why I used URL decode here.

harsha89 · 2019-08-03T18:33:20Z

...gateway/src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/jwt/JWTValidator.java

+            header = new JSONObject(new String(Base64.getUrlDecoder().decode(splitToken[0])));
+        } catch (JSONException | IllegalArgumentException e) {
+            log.debug("Token decryption failure when retrieving header.", e);
+            throw new APISecurityException(APISecurityConstants.API_AUTH_INVALID_CREDENTIALS,


saying token invalid. Can't we trim and log atkeast last few letters

components/apimgt/org.wso2.carbon.apimgt.gateway/pom.xml

harsha89 · 2019-08-03T18:35:34Z

components/apimgt/org.wso2.carbon.apimgt.gateway/pom.xml

@@ -345,6 +349,7 @@
                            org.apache.synapse.endpoints.*,
                            org.apache.synapse.mediators.base,
                            org.apache.axis2.transport.base,
+                            io.swagger.parser.*; version="${openapitools.swagger.parser.version}",


better to import version range

harsha89 · 2019-08-03T18:36:47Z

...gateway/src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/jwt/JWTValidator.java

+        if (!isVerified) {
+            log.debug("Token not found in the cache.");
+            try {
+                payload = new JSONObject(new String(Base64.getUrlDecoder().decode(splitToken[1])));


posiible array index out of bounds/

this split length validation is happening at the OAuthAuthenticator so when we hit this method, it should definitely have an array of length 3

CLAassistant · 2019-08-05T10:18:14Z

All committers have signed the CLA.

… domain of jwt token

…d API DTO object

…ext in JWT validator

…ubscribed API DTO object" This reverts commit e00305f.

…uth context in JWT validator" This reverts commit 2a1cf73.

…ext in JWT validator

isharac · 2020-07-16T02:16:41Z

...src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/oauth/OAuthAuthenticator.java

+                        if (StringUtils.countMatches(apiKey, APIConstants.DOT) != 2) {
+                            log.debug("Invalid JWT token. The expected token format is <header.payload.signature>");
+                            throw new APISecurityException(APISecurityConstants.API_AUTH_INVALID_CREDENTIALS,
+                                    "Invalid JWT token");


Cant we state the same debug message here as well?
It provides a hint.

Fixed in #9250

isharac · 2020-07-16T02:19:11Z

...src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/oauth/OAuthAuthenticator.java

+                try {
+                    AuthenticationContext authenticationContext = jwtValidator.authenticate(apiKey, synCtx, openAPI);
+                    APISecurityUtils.setAuthenticationContext(synCtx, authenticationContext, securityContextHeader);
+                    log.debug("User is authorized using JWT token to access the resource.");


improve the debug log by appending specific information such as user etc

Fixed in #9250

...gateway/src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/jwt/JWTValidator.java

…28.196

…velopment iteration

Chamod Samarajeewa added 2 commits August 1, 2019 09:37

Remove Swagger Parser import from hostobject component

fbb59f1

Merge remote-tracking branch 'upstream/master'

560a386

harsha89 requested changes Aug 3, 2019

View reviewed changes

ChamodDamitha force-pushed the jwt-authentication branch 2 times, most recently from d92610f to 30dcba2 Compare August 5, 2019 09:16

Chamod Samarajeewa added 24 commits August 6, 2019 00:44

Merge remote-tracking branch 'upstream/master'

e5595fa

Add JWT token signature validation

84962a3

Update authentication context with jwt token payload information

2686ad2

Set subscriber name to fully qualified name and fix subscriber tenant…

f719321

… domain of jwt token

Fix jwt token validation for tenant mode

9868cc2

Add scope validation to JWT validator

f4dc251

Add JWT token expiry validation

8b72be1

Update auth context generation in JWT validator

66b697b

Add spikeArrestLimit,spikeArrestUnit,StopOnQuota deatils to subscribe…

b802728

…d API DTO object

Add spikeArrestLimit,spikeArrestUnit,StopOnQuota deatils to auth cont…

8a7da64

…ext in JWT validator

Add subscription validation for JWT validator

055ccbc

Set API tier using handler property at JWT validator

5d6449e

Add jwt token caching

b80ee1d

Update jwt token expiration check

74195ab

Add susbscription tiers' information to jwt token

98c6602

Revert "Add spikeArrestLimit,spikeArrestUnit,StopOnQuota deatils to s…

c88a1d8

…ubscribed API DTO object" This reverts commit e00305f.

Revert "Add spikeArrestLimit,spikeArrestUnit,StopOnQuota deatils to a…

337e146

…uth context in JWT validator" This reverts commit 2a1cf73.

Add spikeArrestLimit,spikeArrestUnit,StopOnQuota deatils to auth cont…

8b91821

…ext in JWT validator

Add grant type to jwt token

f9f1a4f

Add SwaggerUtils

8a55351

Move swagger parsing logic to APIAuthenticationHandler

52e60d3

Add resource authentication with jwt auth

5795bba

Add token grant type validation to JWT validator

3680318

Format and optimize code

4951acc

Chamod Samarajeewa added 9 commits August 6, 2019 00:44

Add JWT validator unit tests

5041efd

Update jwt signature verification

9b3a7c0

Format and optimize code

06a0f96

Update JWT token signature verification

01a4b09

Update grant type validation using token scopes

c667ffc

Remove grant type validationn and optimize code

0d99452

Add trustore read functionality to bundle activate method

f222439

Emebed backend JWT token to the JWT access token

8e9e578

Replace SwaggerParser with OpenAPIParser

9138ad6

ChamodDamitha force-pushed the jwt-authentication branch from 30dcba2 to 0254f10 Compare August 6, 2019 06:26

Format and optimize code

380ec16

ChamodDamitha force-pushed the jwt-authentication branch from 0254f10 to 380ec16 Compare August 6, 2019 07:03

harsha89 approved these changes Aug 7, 2019

View reviewed changes

harsha89 merged commit 5ce5e36 into wso2:master Aug 7, 2019

isharac reviewed Jul 16, 2020

View reviewed changes

shilmyhasan reviewed Jul 21, 2020

View reviewed changes

...gateway/src/main/java/org/wso2/carbon/apimgt/gateway/handlers/security/jwt/JWTValidator.java Show resolved Hide resolved

wso2-jenkins-bot added a commit that referenced this pull request Dec 4, 2023

[WSO2 Release] [Jenkins #6769] [Release 9.28.196] prepare release v9.…

01c310b

…28.196

wso2-jenkins-bot added a commit that referenced this pull request Dec 4, 2023

[WSO2 Release] [Jenkins #6769] [Release 9.28.196] prepare for next de…

7e0120c

…velopment iteration

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

JWT Authentication for API Gateway #6769

JWT Authentication for API Gateway #6769

ChamodDamitha commented Aug 3, 2019

harsha89 Aug 3, 2019

ChamodDamitha Aug 4, 2019 •

edited

Loading

harsha89 Aug 3, 2019

ChamodDamitha Aug 4, 2019

harsha89 Aug 3, 2019

ChamodDamitha Aug 5, 2019

harsha89 Aug 3, 2019

ChamodDamitha Aug 6, 2019

harsha89 Aug 3, 2019

ChamodDamitha Aug 4, 2019

CLAassistant commented Aug 5, 2019 •

edited

Loading

isharac Jul 16, 2020

ChamodDamitha Aug 28, 2020

isharac Jul 16, 2020

ChamodDamitha Aug 28, 2020

JWT Authentication for API Gateway #6769

JWT Authentication for API Gateway #6769

Conversation

ChamodDamitha commented Aug 3, 2019

Choose a reason for hiding this comment

ChamodDamitha Aug 4, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CLAassistant commented Aug 5, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ChamodDamitha Aug 4, 2019 •

edited

Loading

CLAassistant commented Aug 5, 2019 •

edited

Loading