[keycloak-user] Validating JWT tokens

[Stian Thorgersen]

On 4 May 2016 at 18:37, Aikeaguinea <aikeaguinea at xsmail.com> wrote:

> Figured it out, kinda. I have to use the Realm public key, and at least
> in jwt.io it has to begin with "-----BEGIN PUBLIC KEY-----" and end with
> "-----END PUBLIC KEY-----" -- these can't be omitted.
>
> If I try using the Realm certificate, it won't work, however, whether or
> not I use "-----BEGIN CERTIFICATE-----"/"-----END CERTIFICATE-----".
>
> If I use the validator at http://kjur.github.io/jsjws/tool_jwt.html and
> select "default X509 Certificate (RSA z4) it tells me "Error: malformed
> X.509 certificate PEM (code:003)"
>
> I can use the Realm public key for validating the JWT, but shouldn't the
> certificate work as well?
>

The certificate is only used by SAML, so no you can't verify the JWT with
the certificate only the public key.


>
> On Wed, May 4, 2016, at 12:00 PM, Aikeaguinea wrote:
> > I have a client with a service account and credentials using Signed Jwt.
> > Authentication works fine. The service uses
> >
> org.keycloak.adapters.authentication.ClientCredentialsProviderUtils#setClientCredentials
> > to create the JWT token and set the headers, and I get back a JWT
> > containing an access token from Keycloak.
> >
> > However, when I use jwt.io to look at the access token, I can't validate
> > the signature. This is true whether I use the client Certificate (from
> > the client's Credentials tab), the Realm public key, or the Realm
> > Certificate. In addition, I have generated the client's public key from
> > the certificate using
> >
> > keytool -exportcert -alias x -keypass y -storepass z -rfc -keystore
> > client-keystore.jks | openssl x509 -inform pem -pubkey
> >
> > on the jks file supplied when I generated the client credentials, and
> > that doesn't work either.
> >
> > We've also been having trouble validating the signature programmatically
> > using Java.
> >
> > Any idea why I might be seeing this?
> >
> > --
> > http://www.fastmail.com - Or how I learned to stop worrying and
> >                           love email again
> >
>
>
> --
>   Aikeaguinea
>   aikeaguinea at xsmail.com
>
> --
> http://www.fastmail.com - Send your email first class
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160506/507ae44a/attachment-0001.html