Skip to content

Commit 1bd7499

Browse files
bruthbruth
committed
Add example for jwt user perms
Signed-off-by: Byron Ruth <b@devel.io>
1 parent 881727d commit 1bd7499

6 files changed

Lines changed: 275 additions & 0 deletions

File tree

‎examples/auth/jwt-perms/cli/Dockerfile‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
FROM natsio/nats-box:0.13.1
2+
3+
# Copy nats-server from source image.
4+
COPY --from=nats:2.9.6-alpine /usr/local/bin/nats-server /usr/local/bin/
5+
6+
COPY . .
7+
8+
CMD ["main.sh"]
9+

‎examples/auth/jwt-perms/cli/main.sh‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
#!/bin/sh
2+
3+
set -uo pipefail
4+
5+
NATS_URL="${NATS_URL:-nats://localhost:4222}"
6+
7+
# Create the operator, generate a signing key (which is a best practice),
8+
# and initialize the default SYS account and sys user.
9+
nsc add operator --generate-signing-key --sys --name local
10+
11+
# A follow-up edit of the operator enforces signing keys are used for
12+
# accounts as well. Setting the server URL is a convenience so that
13+
# it does not need to be specified with call `nsc push`.
14+
nsc edit operator --require-signing-keys \
15+
--account-jwt-server-url "$NATS_URL"
16+
17+
# Next we need to create an account intended for application usage. It is
18+
# currently a two-step process to create the account, followed by
19+
# generating the signing key.
20+
nsc add account APP
21+
nsc edit account APP --sk generate
22+
23+
# This command generates the bit of configuration to be used by the server
24+
# to setup the embedded JWT resolver.
25+
nsc generate config --nats-resolver --sys-account SYS > resolver.conf
26+
27+
# Create the most basic config that simply include the generated
28+
# resolver config.
29+
cat <<- EOF > server.conf
30+
include resolver.conf
31+
EOF
32+
33+
# Start the server.
34+
nats-server -c server.conf 2> /dev/null &
35+
SERVER_PID=$!
36+
37+
sleep 1
38+
39+
# Push the account up to the server.
40+
nsc push -a APP
41+
42+
# The next two users emulate consumers of the service. They can publish
43+
# on their own prefixed subject as well as publish to services scoped the
44+
# their respective name.
45+
nsc add user --account APP joe \
46+
--allow-pub 'joe' \
47+
--allow-sub 'joe' \
48+
49+
nsc add user --account APP pam \
50+
--allow-pub 'pam' \
51+
--allow-sub 'pam'
52+
53+
# A nice side effect of this is that now, joe and pam can't subscribe
54+
# to each other's subjects, however, what about `_INBOX.>`? Let's observe
55+
# the current behavior and then see how we can address this.
56+
57+
# First, let's save a few contexts for easier reference.
58+
nats context save joe \
59+
--nsc nsc://local/APP/joe
60+
61+
nats context save pam \
62+
--nsc nsc://local/APP/pam
63+
64+
# Attempt to subscribe to the other user.. should get permission violation.
65+
echo 'Attempting to subscribe to pam by joe..'
66+
nats --context joe sub 'pam'
67+
echo 'Attempting to subscribe to joe by pam..'
68+
nats --context pam sub 'joe'
69+
70+
# Subscribe to the correct user..
71+
nats --context joe sub 'joe' &
72+
nats --context pam sub 'pam' &
73+
74+
# Publish to the wrong user..
75+
nats --context joe pub 'pam' ''
76+
nats --context pam pub 'sue' ''
77+
78+
# Publish to the right user..
79+
nats --context joe pub 'joe' ''
80+
nats --context pam pub 'pam' ''

‎examples/auth/jwt-perms/cli/output.cast‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{"version": 2, "width": 0, "height": 0, "timestamp": 1659460868, "env": {"SHELL": null, "TERM": null}, "title": "NATS by Example: auth/private-inbox-jwt/cli"}
2+
[0.534395, "o", "Network b7bfbec0_default Creating\r\n"]
3+
[0.582083, "o", "Network b7bfbec0_default Created\r\n"]
4+
[0.978432, "o", " _ _ \r\n _ __ __ _| |_ ___ | |__ _____ __\r\n| '_ \\ / _` | __/ __|_____| '_ \\ / _ \\ \\/ /\r\n| | | | (_| | |_\\__ \\_____| |_) | (_) > < \r\n|_| |_|\\__,_|\\__|___/ |_.__/ \\___/_/\\_\\\r\n \r\n"]
5+
[0.982063, "o", "nats-box v0.12.0\r\n"]
6+
[0.989531, "o", "[ OK ] generated and stored operator key \"ODFMSKLO5IXEZEYGRURAIXESSKTOITJY6J5ENUZM2DOPODARGAMRCBYE\"\r\n[ OK ] added operator \"local\"\r\n[ OK ] When running your own nats-server, make sure they run at least version 2.2.0\r\n[ OK ] created operator signing key: OBVV4SZH4LGW2DTKN75CFDKPI3EAPG2JY55R3YOOKYPVOPTW6QLLKRSV\r\n[ OK ] created system_account: name:SYS id:ABBGTNCV4YW7PFBT6J5DCT4E7MFJPINFPAKZKYX3YEDOBD2B2CKJNYJI\r\n[ OK ] created system account user: name:sys id:UAX4G37MYJSFKJZAYW4DCBPZNWYUQSFHEJTJVDICYXTSFWFU4OSM76RD\r\n[ OK ] system account user creds file stored in `/nsc/nkeys/creds/local/SYS/sys.creds`\r\n"]
7+
[0.998342, "o", "[ OK ] strict signing key usage set to: true\r\n[ OK ] set account jwt server url to \"nats://localhost:4222\"\r\n[ OK ] edited operator \"local\"\r\n"]
8+
[1.006799, "o", "[ OK ] generated and stored account key \"AB5MLX47CDR6HLNI7CGRRAOPHZXHA5WLLZBCM3Y5M5ITSBZWT66HBDUZ\"\r\n[ OK ] added account \"APP\"\r\n"]
9+
[1.015887, "o", "[ OK ] added signing key \"AAT6RZPFDH5Y4HRDO554REFLEZXC7OC6YLI6ED3SCYNFZ4NDMYY7WB65\"\r\n[ OK ] edited account \"APP\"\r\n"]
10+
[3.035293, "o", "[ OK ] push to nats-server \"nats://localhost:4222\" using system account \"SYS\":\r\n [ OK ] push APP to nats-server with nats account resolver:\r\n [ OK ] pushed \"APP\" to nats-server NCXGMGNQBBKCTS3LO2SLVRCZP7CJGO6GWSR6KADR4Y3D6LG7TQS2S6AB: jwt updated\r\n [ OK ] pushed to a total of 1 nats-server\r\n"]
11+
[3.045105, "o", "[ OK ] set max responses to 1"]
12+
[3.045266, "o", "\r\n[ OK ] added sub \"services.greet\"\r\n[ OK ] generated and stored user key \"UBAK6JLWQMHXEJ4WCFGVRKZYCBHLCNI6JGFHFMUODPNL27ZHOYOCHOO3\"\r\n[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/greeter.creds`\r\n[ OK ] added user \"greeter\" to account \"APP\"\r\n"]
13+
[3.054862, "o", "[ OK ] added pub pub \"joe.>\"\r\n[ OK ] added pub pub \"services.*\"\r\n[ OK ] generated and stored user key \"UARFKBJRTAZM4OW3WZIPOXAV5BCS3JH6BCCUARVFHJDFJ7IY2HXJUXLJ\"\r\n[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/joe.creds`\r\n[ OK ] added user \"joe\" to account \"APP\"\r\n"]
14+
[3.064655, "o", "[ OK ] added pub pub \"pam.>\"\r\n[ OK ] added pub pub \"services.*\"\r\n[ OK ] generated and stored user key \"UBYSMJ3Y366XN5H6JP5IHNQ3M76CTXK2BRXSTK2C75HY7LFRUASGT3OV\"\r\n[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/pam.creds`\r\n[ OK ] added user \"pam\" to account \"APP\"\r\n"]
15+
[3.073656, "o", "[ OK ] added sub \"_INBOX.>\"\r\n[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/joe.creds`\r\n[ OK ] edited user \"joe\"\r\n"]
16+
[3.081963, "o", "[ OK ] added sub \"_INBOX.>\"\r\n[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/pam.creds`\r\n[ OK ] edited user \"pam\"\r\n"]
17+
[3.130207, "o", "NATS Configuration Context \"greeter\"\r\n\r\n Server URLs: nats://127.0.0.1:4222\r\n Credentials: /nsc/nkeys/creds/local/APP/greeter.creds (OK)\r\n NSC Lookup: nsc://local/APP/greeter\r\n Path: /nsc/.config/nats/context/greeter.json\r\n\r\n"]
18+
[3.181706, "o", "NATS Configuration Context \"joe\"\r\n\r\n Server URLs: nats://127.0.0.1:4222\r\n Credentials: /nsc/nkeys/creds/local/APP/joe.creds (OK)\r\n NSC Lookup: nsc://local/APP/joe\r\n Path: /nsc/.config/nats/context/joe.json\r\n\r\n"]
19+
[3.236577, "o", "NATS Configuration Context \"pam\"\r\n\r\n Server URLs: nats://127.0.0.1:4222\r\n Credentials: /nsc/nkeys/creds/local/APP/pam.creds (OK)\r\n NSC Lookup: nsc://local/APP/pam\r\n Path: /nsc/.config/nats/context/pam.json\r\n\r\n"]
20+
[3.290534, "o", "17:21:11 Listening on \"services.greet\" in group \"NATS-RPLY-22\"\r\n"]
21+
[3.790941, "o", "17:21:11 Sending request on \"services.greet\"\r\n"]
22+
[3.791691, "o", "\r\n\r\n17:21:11 [#0] Received on subject \"services.greet\":\r\n"]
23+
[3.792571, "o", "17:21:11 Received with rtt 1.421611ms\r\nReply EiaIxD2O9zht77dHYbTZfN\r\n\r\n"]
24+
[3.834159, "o", "17:21:11 Sending request on \"services.greet\"\r\n"]
25+
[3.834882, "o", "17:21:11 [#1] Received on subject \"services.greet\":\r\n"]
26+
[3.835287, "o", "\r\n\r\n"]
27+
[3.835725, "o", "17:21:11 Received with rtt 1.089909ms\r\n"]
28+
[3.836015, "o", "Reply EiaIxD2O9zht77dHYbTZk4\r\n\r\n"]
29+
[3.88255, "o", "17:21:12 Subscribing on _INBOX.>\r\n"]
30+
[3.892191, "o", "17:21:12 Sending request on \"services.greet\"\r\n"]
31+
[3.893543, "o", "17:21:12 [#2] Received on subject \"services.greet\":"]
32+
[3.893662, "o", "\r\n\r\n\r\n"]
33+
[3.894649, "o", "Reply EiaIxD2O9zht77dHYbTZol\r\n\r\n17:21:12 Received with rtt 681.706µs\r\n"]
34+
[3.895325, "o", "[#1] Received on \"_INBOX.ZYAAExoXcyDKsFDdxuFgQb.PIt1MPL3\"\r\nReply EiaIxD2O9zht77dHYbTZol\r\n\r\n"]
35+
[3.944688, "o", "17:21:12 Sending request on \"services.greet\"\r\n"]
36+
[3.945738, "o", "17:21:12 [#3] Received on subject \"services.greet\":\r\n17:21:12 Unexpected NATS error from server nats://127.0.0.1:4222: nats: Permissions Violation for Subscription to \"_INBOX_joe.fNg5JF7k4bT2VSUa4Ep6wD.7tIj5Fxs\"\r\n\r\n"]
37+
[3.946382, "o", "\r\n"]
38+
[8.95523, "o", "[ OK ] added sub \"_INBOX_joe.>\"\r\n[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/joe.creds`\r\n[ OK ] edited user \"joe\"\r\n"]
39+
[8.964557, "o", "[ OK ] added sub \"_INBOX_pam.>\"\r\n[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/pam.creds`\r\n[ OK ] edited user \"pam\"\r\n"]
40+
[9.016086, "o", "17:21:17 Subscribing on _INBOX.>\r\n"]
41+
[9.017507, "o", "17:21:17 Unexpected NATS error from server nats://127.0.0.1:4222: nats: Permissions Violation for Subscription to \"_INBOX.>\"\r\n"]
42+
[9.018267, "o", "nats: error: nats: Permissions Violation for Subscription to \"_INBOX.>\", try --help\r\n"]
43+
[9.069782, "o", "17:21:17 Subscribing on _INBOX_joe.>\r\n"]
44+
[9.070286, "o", "nats: error: nats: Permissions Violation for Subscription to \"_INBOX_joe.>\", try --help\r\n"]
45+
[9.121882, "o", "17:21:17 Sending request on \"services.greet\"\r\n"]
46+
[9.122746, "o", "\r\n\r\n17:21:17 [#4] Received on subject \"services.greet\":\r\n"]
47+
[9.123573, "o", "17:21:17 Received with rtt 1.093234ms\r\nReply EiaIxD2O9zht77dHYbTZy9\r\n\r\n"]
48+
[9.173329, "o", "17:21:17 Sending request on \"services.greet\"\r\n"]
49+
[9.17416, "o", "17:21:17 [#5] Received on subject \"services.greet\":\r\n"]
50+
[9.174298, "o", "\r\n"]
51+
[9.17484, "o", "\r\n"]
52+
[9.176812, "o", "17:21:17 Received with rtt 2.893689ms\r\nReply EiaIxD2O9zht77dHYbTa2q\r\n\r\n"]

‎examples/auth/jwt-perms/cli/output.txt‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
Network b7bfbec0_default Creating
2+
Network b7bfbec0_default Created
3+
_ _
4+
_ __ __ _| |_ ___ | |__ _____ __
5+
| '_ \ / _` | __/ __|_____| '_ \ / _ \ \/ /
6+
| | | | (_| | |_\__ \_____| |_) | (_) > <
7+
|_| |_|\__,_|\__|___/ |_.__/ \___/_/\_\
8+
9+
nats-box v0.12.0
10+
[ OK ] generated and stored operator key "ODFMSKLO5IXEZEYGRURAIXESSKTOITJY6J5ENUZM2DOPODARGAMRCBYE"
11+
[ OK ] added operator "local"
12+
[ OK ] When running your own nats-server, make sure they run at least version 2.2.0
13+
[ OK ] created operator signing key: OBVV4SZH4LGW2DTKN75CFDKPI3EAPG2JY55R3YOOKYPVOPTW6QLLKRSV
14+
[ OK ] created system_account: name:SYS id:ABBGTNCV4YW7PFBT6J5DCT4E7MFJPINFPAKZKYX3YEDOBD2B2CKJNYJI
15+
[ OK ] created system account user: name:sys id:UAX4G37MYJSFKJZAYW4DCBPZNWYUQSFHEJTJVDICYXTSFWFU4OSM76RD
16+
[ OK ] system account user creds file stored in `/nsc/nkeys/creds/local/SYS/sys.creds`
17+
[ OK ] strict signing key usage set to: true
18+
[ OK ] set account jwt server url to "nats://localhost:4222"
19+
[ OK ] edited operator "local"
20+
[ OK ] generated and stored account key "AB5MLX47CDR6HLNI7CGRRAOPHZXHA5WLLZBCM3Y5M5ITSBZWT66HBDUZ"
21+
[ OK ] added account "APP"
22+
[ OK ] added signing key "AAT6RZPFDH5Y4HRDO554REFLEZXC7OC6YLI6ED3SCYNFZ4NDMYY7WB65"
23+
[ OK ] edited account "APP"
24+
[ OK ] push to nats-server "nats://localhost:4222" using system account "SYS":
25+
[ OK ] push APP to nats-server with nats account resolver:
26+
[ OK ] pushed "APP" to nats-server NCXGMGNQBBKCTS3LO2SLVRCZP7CJGO6GWSR6KADR4Y3D6LG7TQS2S6AB: jwt updated
27+
[ OK ] pushed to a total of 1 nats-server
28+
[ OK ] set max responses to 1
29+
[ OK ] added sub "services.greet"
30+
[ OK ] generated and stored user key "UBAK6JLWQMHXEJ4WCFGVRKZYCBHLCNI6JGFHFMUODPNL27ZHOYOCHOO3"
31+
[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/greeter.creds`
32+
[ OK ] added user "greeter" to account "APP"
33+
[ OK ] added pub pub "joe.>"
34+
[ OK ] added pub pub "services.*"
35+
[ OK ] generated and stored user key "UARFKBJRTAZM4OW3WZIPOXAV5BCS3JH6BCCUARVFHJDFJ7IY2HXJUXLJ"
36+
[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/joe.creds`
37+
[ OK ] added user "joe" to account "APP"
38+
[ OK ] added pub pub "pam.>"
39+
[ OK ] added pub pub "services.*"
40+
[ OK ] generated and stored user key "UBYSMJ3Y366XN5H6JP5IHNQ3M76CTXK2BRXSTK2C75HY7LFRUASGT3OV"
41+
[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/pam.creds`
42+
[ OK ] added user "pam" to account "APP"
43+
[ OK ] added sub "_INBOX.>"
44+
[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/joe.creds`
45+
[ OK ] edited user "joe"
46+
[ OK ] added sub "_INBOX.>"
47+
[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/pam.creds`
48+
[ OK ] edited user "pam"
49+
NATS Configuration Context "greeter"
50+
51+
Server URLs: nats://127.0.0.1:4222
52+
Credentials: /nsc/nkeys/creds/local/APP/greeter.creds (OK)
53+
NSC Lookup: nsc://local/APP/greeter
54+
Path: /nsc/.config/nats/context/greeter.json
55+
56+
NATS Configuration Context "joe"
57+
58+
Server URLs: nats://127.0.0.1:4222
59+
Credentials: /nsc/nkeys/creds/local/APP/joe.creds (OK)
60+
NSC Lookup: nsc://local/APP/joe
61+
Path: /nsc/.config/nats/context/joe.json
62+
63+
NATS Configuration Context "pam"
64+
65+
Server URLs: nats://127.0.0.1:4222
66+
Credentials: /nsc/nkeys/creds/local/APP/pam.creds (OK)
67+
NSC Lookup: nsc://local/APP/pam
68+
Path: /nsc/.config/nats/context/pam.json
69+
70+
17:21:11 Listening on "services.greet" in group "NATS-RPLY-22"
71+
17:21:11 Sending request on "services.greet"
72+
73+
74+
17:21:11 [#0] Received on subject "services.greet":
75+
17:21:11 Received with rtt 1.421611ms
76+
Reply EiaIxD2O9zht77dHYbTZfN
77+
78+
17:21:11 Sending request on "services.greet"
79+
17:21:11 [#1] Received on subject "services.greet":
80+
81+
82+
17:21:11 Received with rtt 1.089909ms
83+
Reply EiaIxD2O9zht77dHYbTZk4
84+
85+
17:21:12 Subscribing on _INBOX.>
86+
17:21:12 Sending request on "services.greet"
87+
17:21:12 [#2] Received on subject "services.greet":
88+
89+
90+
Reply EiaIxD2O9zht77dHYbTZol
91+
92+
17:21:12 Received with rtt 681.706µs
93+
[#1] Received on "_INBOX.ZYAAExoXcyDKsFDdxuFgQb.PIt1MPL3"
94+
Reply EiaIxD2O9zht77dHYbTZol
95+
96+
17:21:12 Sending request on "services.greet"
97+
17:21:12 [#3] Received on subject "services.greet":
98+
17:21:12 Unexpected NATS error from server nats://127.0.0.1:4222: nats: Permissions Violation for Subscription to "_INBOX_joe.fNg5JF7k4bT2VSUa4Ep6wD.7tIj5Fxs"
99+
100+
101+
[ OK ] added sub "_INBOX_joe.>"
102+
[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/joe.creds`
103+
[ OK ] edited user "joe"
104+
[ OK ] added sub "_INBOX_pam.>"
105+
[ OK ] generated user creds file `/nsc/nkeys/creds/local/APP/pam.creds`
106+
[ OK ] edited user "pam"
107+
17:21:17 Subscribing on _INBOX.>
108+
17:21:17 Unexpected NATS error from server nats://127.0.0.1:4222: nats: Permissions Violation for Subscription to "_INBOX.>"
109+
nats: error: nats: Permissions Violation for Subscription to "_INBOX.>", try --help
110+
17:21:17 Subscribing on _INBOX_joe.>
111+
nats: error: nats: Permissions Violation for Subscription to "_INBOX_joe.>", try --help
112+
17:21:17 Sending request on "services.greet"
113+
114+
115+
17:21:17 [#4] Received on subject "services.greet":
116+
17:21:17 Received with rtt 1.093234ms
117+
Reply EiaIxD2O9zht77dHYbTZy9
118+
119+
17:21:17 Sending request on "services.greet"
120+
17:21:17 [#5] Received on subject "services.greet":
121+
122+
123+
17:21:17 Received with rtt 2.893689ms
124+
Reply EiaIxD2O9zht77dHYbTa2q
125+

‎examples/auth/jwt-perms/docker-compose.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
version: '3.9'
2+
services:
3+
app:
4+
image: ${IMAGE_TAG}
5+
ports:
6+
- "14222:4222"
7+
- "14223:4223"

‎examples/auth/jwt-perms/meta.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
title: JWT user perms
2+
description: |-

0 commit comments

Comments
 (0)