Re: [keycloak-user] Validating JWT tokens
Figured it out, kinda. I have to use the Realm public key, and at least
in jwt.io it has to begin with "-----BEGIN PUBLIC KEY-----" and end with
"-----END PUBLIC KEY-----" -- these can't be omitted.
If I try using the Realm certificate, it won't work, however, whether or
not I use "-----BEGIN CERTIFICATE-----"/"-----END CERTIFICATE-----".
If I use the validator at http://kjur.github.io/jsjws/tool_jwt.html and
select "default X509 Certificate (RSA z4) it tells me "Error: malformed
X.509 certificate PEM (code:003)"
I can use the Realm public key for validating the JWT, but shouldn't the
certificate work as well?
On Wed, May 4, 2016, at 12:00 PM, Aikeaguinea wrote:
I have a client with a service account and credentials using Signed
Jwt.
Authentication works fine. The service uses
org.keycloak.adapters.authentication.ClientCredentialsProviderUtils#setClientCredentials
to create the JWT token and set the headers, and I get back a JWT
containing an access token from Keycloak.
However, when I use jwt.io to look at the access token, I can't validate
the signature. This is true whether I use the client Certificate (from
the client's Credentials tab), the Realm public key, or the Realm
Certificate. In addition, I have generated the client's public key from
the certificate using
keytool -exportcert -alias x -keypass y -storepass z -rfc -keystore
client-keystore.jks | openssl x509 -inform pem -pubkey
on the jks file supplied when I generated the client credentials, and
that doesn't work either.
We've also been having trouble validating the signature programmatically
using Java.
Any idea why I might be seeing this?
--
http://www.fastmail.com - Or how I learned to stop worrying and
love email again
--
Aikeaguinea
aikeaguinea(a)xsmail.com
--
http://www.fastmail.com - Send your email first class