Tyk + JWT HMAC validation error

Support Installation and Deployment
,
17

Hi,

So I spent some time replicating this with a fresh CE installation and got it all working :slight_smile:

There’s a couple of things that might have gone wrong, so instead, here’s a working set of files:

test_api_3.json 

{
    "name": "JWT-TEST",
    "slug": "jwt-test",
    "api_id": "3",
    "org_id": "test-org",
    "use_keyless": false,
    "use_oauth2": false,
    "use_openid": false,
    "openid_options": {
        "providers": [],
        "segregate_by_client": false
    },
    "oauth_meta": {
        "allowed_access_types": [],
        "allowed_authorize_types": [],
        "auth_login_redirect": ""
    },
    "auth": {
        "use_param": false,
        "param_name": "",
        "use_cookie": false,
        "cookie_name": "",
        "auth_header_name": "Authorization"
    },
    "use_basic_auth": false,
    "enable_jwt": true,
    "use_standard_auth": false,
    "enable_coprocess_auth": false,
    "jwt_signing_method": "hmac",
    "jwt_source": "d3hJUEY2bGZ2SVFSaE9HMHoxQTBRd3hOUmZkak96Z2Y=",
    "jwt_identity_base_field": "sub",
    "jwt_client_base_field": "",
    "jwt_policy_field_name": "policy-id",
    "notifications": {
        "shared_secret": "",
        "oauth_on_keychange_url": ""
    },
    "enable_signature_checking": false,
    "hmac_allowed_clock_skew": -1,
    "base_identity_provided_by": "",
    "definition": {
        "location": "header",
        "key": "x-api-version"
    },
    "version_data": {
        "not_versioned": true,
        "versions": {
            "Default": {
                "name": "Default",
                "expires": "",
                "paths": {
                    "ignored": [],
                    "white_list": [],
                    "black_list": []
                },
                "use_extended_paths": true,
                "extended_paths": {},
                "global_headers": {},
                "global_headers_remove": [],
                "global_size_limit": 0,
                "override_target": ""
            }
        }
    },
    "uptime_tests": {
        "check_list": [],
        "config": {
            "expire_utime_after": 0,
            "service_discovery": {
                "use_discovery_service": false,
                "query_endpoint": "",
                "use_nested_query": false,
                "parent_data_path": "",
                "data_path": "",
                "port_data_path": "",
                "target_path": "",
                "use_target_list": false,
                "cache_timeout": 60,
                "endpoint_returns_list": false
            },
            "recheck_wait": 0
        }
    },
    "proxy": {
        "preserve_host_header": false,
        "listen_path": "/test-3/",
        "target_url": "http://httpbin.org/",
        "strip_listen_path": true,
        "enable_load_balancing": false,
        "target_list": [],
        "check_host_against_uptime_tests": false,
        "service_discovery": {
            "use_discovery_service": false,
            "query_endpoint": "",
            "use_nested_query": false,
            "parent_data_path": "",
            "data_path": "hostname",
            "port_data_path": "port",
            "target_path": "/api-slug",
            "use_target_list": false,
            "cache_timeout": 60,
            "endpoint_returns_list": false
        }
    },
    "disable_rate_limit": false,
    "disable_quota": false,
    "custom_middleware": {
        "pre": [],
        "post": [],
        "post_key_auth": [],
        "auth_check": {
            "name": "",
            "path": "",
            "require_session": false
        },
        "response": [],
        "driver": "",
        "id_extractor": {
            "extract_from": "",
            "extract_with": "",
            "extractor_config": {}
        }
    },
    "custom_middleware_bundle": "",
    "cache_options": {
        "cache_timeout": 60,
        "enable_cache": true,
        "cache_all_safe_requests": false,
        "cache_response_codes": [],
        "enable_upstream_cache_control": false
    },
    "session_lifetime": 0,
    "active": true,
    "auth_provider": {
        "name": "",
        "storage_engine": "",
        "meta": {}
    },
    "session_provider": {
        "name": "",
        "storage_engine": "",
        "meta": null
    },
    "event_handlers": {
        "events": {}
    },
    "enable_batch_request_support": false,
    "enable_ip_whitelisting": false,
    "allowed_ips": [],
    "dont_set_quota_on_create": false,
    "expire_analytics_after": 0,
    "response_processors": [],
    "CORS": {
        "enable": false,
        "allowed_origins": [],
        "allowed_methods": [],
        "allowed_headers": [],
        "exposed_headers": [],
        "allow_credentials": false,
        "max_age": 24,
        "options_passthrough": false,
        "debug": false
    },
    "domain": "",
    "do_not_track": false,
    "tags": [],
    "enable_context_vars": false
}

policies.json 

{
	"1": {
		"rate": 1000,
        "id": "1",
		"per": 1,
		"quota_max": 100,
		"quota_renewal_rate": 60,
		"access_rights": {
			"2": {
				"api_name": "TEST-2",
				"api_id": "2",
				"versions": [
					"Default"
				]
			}
		},
		"org_id": "test-org",
		"hmac_enabled": false
	}
}

I was incorrect when I said that the policies should list out, the file loader doesn’t do that, but since I spend 99% of my time debugging dashboard installs I assumed they were the same :-/

A few things to confirm as well:

  • in tyk.conf the policy record name must be policies.json
  • The entry in the policies.json file for access rights should include the ID twice, you have:
"access_rights": {
    "41433797848f41a558c1573d3e55a410": {
     "api_name": "My API",
     "api_id": "1",
     "versions": [ "Default" ]
    }

You need:

"access_rights": {
    "1": {
     "api_name": "My API",
     "api_id": "1",
     "versions": [ "Default" ]
    }
  • the "jwt_identity_base_field": "sub" entry should be set, otherwise Tyk assumes the “SUB” field, and I’m wondering if it’s case sensitive which might have caused side effects.

There might be other irregularities but I can’t spot them.

To generate my JWT token, I used your secret (not base64 encoded) with this handy tool, the JWT claims looked like this:

{
    "iss": "Online JWT Builder",
    "iat": 1490821744,
    "exp": 1522357744,
    "aud": "www.example.com",
    "sub": "[email protected]",
    "GivenName": "Johnny",
    "Surname": "Rocket",
    "Email": "[email protected]",
    "policy-id": "1",
    "Role": "Project Administrator"
}

And the final JWT was:

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE0OTA4MjE3NDQsImV4cCI6MTUyMjM1Nzc0NCwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIkdpdmVuTmFtZSI6IkpvaG5ueSIsIlN1cm5hbWUiOiJSb2NrZXQiLCJFbWFpbCI6Impyb2NrZTN0QGV4YW1wbGUuY29tIiwicG9saWN5LWlkIjoiMSIsIlJvbGUiOiJQcm9qZWN0IEFkbWluaXN0cmF0b3IifQ.gJ5AfJ24KwpsJrJZbdE-lq9Cz6pEi0L3uIS1PDWFBgo

Let me know if the above templates help.

Cheers,
M.

1 Like