mirror of
https://github.com/taigrr/nats.docs
synced 2025-01-18 04:03:23 -08:00
Better explanation of jwt. Reorganizing files, adding links.
Signed-off-by: Matthias Hanel <mh@synadia.com>
This commit is contained in:
Matthias Hanel
@@ -6,8 +6,7 @@ The NATS server provides various ways of authenticating clients:
|
||||
* [Username/Password credentials](username_password.md)
|
||||
* [TLS Certificate](tls_mutual_auth.md)
|
||||
* [NKEY with Challenge](nkey_auth.md)
|
||||
* [Accounts](accounts.md)
|
||||
* [JWTs](jwt_auth.md)
|
||||
* [Decentralized JWT Authenticatin/Authorization](../jwt/README.md)
|
||||
|
||||
Authentication deals with allowing a NATS client to connect to the server. Except for JWT authentication, authentication and authorization are configured in the `authorization` section of the configuration.
|
||||
|
||||
|
||||
@@ -1,169 +0,0 @@
|
||||
# Accounts
|
||||
|
||||
## Accounts
|
||||
|
||||
_Accounts_ expand on the authentication foundation. With traditional authentication \(except for JWT authentication\), all clients can publish and subscribe to anything unless explicitly configured otherwise. To protect clients and information, you have to carve the subject space and permission clients carefully.
|
||||
|
||||
_Accounts_ allow the grouping of clients, _isolating_ them from clients in other accounts, thus enabling _multi-tenancy_ in the server. With accounts, the subject space is not globally shared, greatly simplifying the messaging environment. Instead of devising complicated subject name carving patterns, clients can use short subjects without explicit authorization rules.
|
||||
|
||||
Accounts configuration is done in `accounts` map. The contents of an account entry includes:
|
||||
|
||||
| Property | Description |
|
||||
| :--- | :--- |
|
||||
| `users` | a list of [user configuration maps](./#user-configuration-map) |
|
||||
| `exports` | a list of export maps |
|
||||
| `imports` | a list of import maps |
|
||||
|
||||
The `accounts` list is a map, where the keys on the map are an account name.
|
||||
|
||||
```text
|
||||
accounts: {
|
||||
A: {
|
||||
users: [
|
||||
{user: a, password: a}
|
||||
]
|
||||
},
|
||||
B: {
|
||||
users: [
|
||||
{user: b, password: b}
|
||||
]
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
> In the most straightforward configuration above you have an account named `A` which has a single user identified by the username `a` and the password `a`, and an account named `B` with a user identified by the username `b` and the password `b`.
|
||||
>
|
||||
> These two accounts are isolated from each other. Messages published by users in `A` are not visible to users in `B`.
|
||||
>
|
||||
> The user configuration map is the same as any other NATS [user configuration map](./#user-configuration-map). You can use:
|
||||
>
|
||||
> * username/password
|
||||
> * nkeys
|
||||
> * and add permissions
|
||||
>
|
||||
> While the name _account_ implies one or more users, it is much simpler and enlightening to think of one account as a messaging container for one application. Users in the account are simply the minimum number of services that must work together to provide some functionality. In simpler terms, more accounts with few \(even one\) clients is a better design topology than a large account with many users with complex authorization configuration.
|
||||
|
||||
### Exporting and Importing
|
||||
|
||||
Messaging exchange between different accounts is enabled by _exporting_ streams and services from one account and _importing_ them into another. Each account controls what is exported and imported.
|
||||
|
||||
The `exports` configuration list enable you to define the services and streams that others can import. Services and streams are expressed as an [Export configuration map](accounts.md#export-configuration-map).
|
||||
|
||||
### Streams
|
||||
|
||||
Streams are messages your application publishes. Importing applications won't be able to make requests from your applications but will be able to consume messages you generate.
|
||||
|
||||
### Services
|
||||
|
||||
Services are messages your application can consume and act on, enabling other accounts to make requests that are fulfilled by your account.
|
||||
|
||||
### Export Configuration Map
|
||||
|
||||
The export configuration map binds a subject for use as a `service` or `stream` and optionally defines specific accounts that can import the stream or service. Here are the supported configuration properties:
|
||||
|
||||
| Property | Description |
|
||||
| :--- | :--- |
|
||||
| `stream` | A subject or subject with wildcards that the account will publish. \(exclusive of `service`\) |
|
||||
| `service` | A subject or subject with wildcards that the account will subscribe to. \(exclusive of `stream`\) |
|
||||
| `accounts` | A list of account names that can import the stream or service. If not specified, the service or stream is public and any account can import it. |
|
||||
|
||||
Here are some example exports:
|
||||
|
||||
```text
|
||||
accounts: {
|
||||
A: {
|
||||
users: [
|
||||
{user: a, password: a}
|
||||
]
|
||||
exports: [
|
||||
{stream: puba.>}
|
||||
{service: pubq.>}
|
||||
{stream: b.>, accounts: [B]}
|
||||
{service: q.b, accounts: [B]}
|
||||
]
|
||||
}
|
||||
...
|
||||
}
|
||||
```
|
||||
|
||||
Here's what `A` is exporting:
|
||||
|
||||
* a public stream on the wildcard subject `puba.>`
|
||||
* a public service on the wildcard subject `pubq.>`
|
||||
* a stream to account `B` on the wildcard subject `a.>`
|
||||
* a service to account `B` on the subject `q.b`
|
||||
|
||||
## Source Configuration Map
|
||||
|
||||
The _source configuration map_ describes an export from a remote account by specifying the `account` and `subject` of the export being imported. This map is embedded in the [import configuration map](accounts.md#import-configuration-map):
|
||||
|
||||
| Property | Description |
|
||||
| :--- | :--- |
|
||||
| `account` | Account name owning the export. |
|
||||
| `subject` | The subject under which the stream or service is made accessible to the importing account |
|
||||
|
||||
### Import Configuration Map
|
||||
|
||||
An import enables an account to consume streams published by another account or make requests to services implemented by another account. All imports require a corresponding export on the exporting account. Accounts cannot do self-imports.
|
||||
|
||||
| Property | Description |
|
||||
| :--- | :--- |
|
||||
| `stream` | Stream import source configuration. \(exclusive of `service`\) |
|
||||
| `service` | Service import source configuration \(exclusive of `stream`\) |
|
||||
| `prefix` | A local subject prefix mapping for the imported stream. |
|
||||
| `to` | A local subject mapping for imported service. |
|
||||
|
||||
The `prefix` and `to` options allow you to remap the subject that is used locally to receive stream messages or publish service requests.
|
||||
|
||||
```text
|
||||
accounts: {
|
||||
A: {
|
||||
users: [
|
||||
{user: a, password: a}
|
||||
]
|
||||
exports: [
|
||||
{stream: puba.>}
|
||||
{service: pubq.>}
|
||||
{stream: b.>, accounts: [B]}
|
||||
{service: q.b, accounts: [B]}
|
||||
]
|
||||
},
|
||||
B: {
|
||||
users: [
|
||||
{user: b, password: b}
|
||||
]
|
||||
imports: [
|
||||
{stream: {account: A, subject: b.>}}
|
||||
{service: {account: A, subject: q.b}}
|
||||
]
|
||||
}
|
||||
C: {
|
||||
users: [
|
||||
{user: c, password: c}
|
||||
]
|
||||
imports: [
|
||||
{stream: {account: A, subject: puba.>}, prefix: from_a}
|
||||
{service: {account: A, subject: pubq.C}, to: Q}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Account `B` imports:
|
||||
|
||||
* the private stream from `A` that only `B` can receive on `b.>`
|
||||
* the private service from `A` that only `B` can send requests on `q.b`
|
||||
|
||||
Account `C` imports the public service and stream from `A`, but also:
|
||||
|
||||
* remaps the `puba.>` stream to be locally available under `from_a.puba.>`. The messages will have their original subjects prefixed by `from_a`.
|
||||
* remaps the `pubq.C` service to be locally available under `Q`. Account `C` only needs to publish to `Q` locally.
|
||||
|
||||
It is important to reiterate that:
|
||||
|
||||
* stream `puba.>` from `A` is visible to all external accounts that imports the stream.
|
||||
* service `pubq.>` from `A` is available to all external accounts so long as they know the full subject of where to send the request. Typically an account will export a wildcard service but then coordinate with a client account on specific subjects where requests will be answered. On our example, account `C` access the service on `pubq.C` \(but has mapped it for simplicity to `Q`\).
|
||||
* stream `b.>` is private, only account `B` can receive messages from the stream.
|
||||
* service `q.b` is private; only account `B` can send requests to the service.
|
||||
* When `C` publishes a request to `Q`, local `C` clients will see `Q` messages. However, the server will remap `Q` to `pubq.C` and forward the requests to account `A`.
|
||||
|
||||
@@ -1,81 +0,0 @@
|
||||
# JWTs
|
||||
|
||||
_Accounts_ expand on [Accounts](accounts.md) and [NKeys](nkey_auth.md) authentication foundation to create a decentralized authentication and authorization model.
|
||||
|
||||
With other authentication mechanisms, configuration for identifying a user or an account is in the server configuration file. JWT authentication leverages [JSON Web Tokens \(JWT\)](https://jwt.io/) to describe the various entities supported. When a client connects, servers query for account JWTs and validate a trust chain. Users are not directly tracked by the server, but rather verified as belonging to an account. This enables the management of users without requiring server configuration updates.
|
||||
|
||||
Effectively, accounts provide for a distributed configuration paradigm. Previously each user \(or client\) needed to be known and authorized a priori in the server’s configuration requiring an administrator to modify and update server configurations. Accounts eliminate these chores.
|
||||
|
||||
## JSON Web Tokens
|
||||
|
||||
[JSON Web Tokens \(JWT\)](https://jwt.io/) are an open and industry standard [RFC7519](https://tools.ietf.org/html/rfc7519) method for representing claims securely between two parties.
|
||||
|
||||
Claims are a fancy way of asserting information on a _subject_. In this context, a _subject_ is the entity being described \(not a messaging subject\). Standard JWT claims are typically digitally signed and verified.
|
||||
|
||||
NATS further restricts JWTs by requiring that JWTs be:
|
||||
|
||||
* Digitally signed _always_ and only using [Ed25519](https://ed25519.cr.yp.to/).
|
||||
* NATS adopts the convention that all _Issuer_ and _Subject_ fields in a JWT claim must be a public [NKEY](nkey_auth.md).
|
||||
* _Issuer_ and _Subject_ must match specific roles depending on the claim [NKeys](https://github.com/nats-io/nkeys).
|
||||
|
||||
### NKey Roles
|
||||
|
||||
NKey Roles are:
|
||||
|
||||
* Operators
|
||||
* Accounts
|
||||
* Users
|
||||
|
||||
Roles are hierarchical and form a chain of trust. Operators issue Accounts which in turn issue Users. Servers trust specific Operators. If an account is issued by an operator that is trusted, account users are trusted.
|
||||
|
||||
## The Authentication Process
|
||||
|
||||
When a _User_ connects to a server, it presents a JWT issued by its _Account_. The user proves its identity by signing a server-issued cryptographic challenge with its private key. The signature verification validates that the signature is attributable to the user's public key. Next, the server retrieves the associated account JWT that issued the user. It verifies the _User_ issuer matches the referenced account. Finally, the server checks that a trusted _Operator_ issued the _Account_, completing the trust chain verification.
|
||||
|
||||
## The Authorization Process
|
||||
|
||||
From an authorization point of view, the account provides information on messaging subjects that are imported from other accounts \(including any ancillary related authorization\) as well as messaging subjects exported to other accounts. Accounts can also bear limits, such as the maximum number of connections they may have. A user JWT can express restrictions on the messaging subjects to which it can publish or subscribe.
|
||||
|
||||
When a new user is added to an account, the account configuration need not change, as each user can and should have its own user JWT that can be verified by simply resolving its parent account.
|
||||
|
||||
## JWTs and Privacy
|
||||
|
||||
One crucial detail to keep in mind is that while in other systems JWTs are used as sessions or proof of authentication, NATS JWTs are only used as configuration describing:
|
||||
|
||||
* the public ID of the entity
|
||||
* the public ID of the entity that issued it
|
||||
* capabilities of the entity
|
||||
|
||||
Authentication is a public key cryptographic process — a client signs a nonce proving identity while the trust chain and configuration provides the authorization.
|
||||
|
||||
The server is never aware of private keys but can verify that a signer or issuer indeed matches a specified or known public key.
|
||||
|
||||
Lastly, all NATS JWTs \(Operators, Accounts, Users and others\) are expected to be signed using the [Ed25519](https://ed25519.cr.yp.to/) algorithm. If they are not, they are rejected by the system.
|
||||
|
||||
## Sharing Between Accounts
|
||||
|
||||
While accounts provide isolation, there are many cases where you want to be able to consume messages produced by one account in another. There are two kinds of shares an account can _export_:
|
||||
|
||||
* Streams
|
||||
* Services
|
||||
|
||||
Streams are messages published by a foreign account; Subscribers in an _importing_ account can receive messages from a stream _exported_ by another.
|
||||
|
||||
Services are endpoints exported by a foreign account; Requesters _importing_ the service can publish requests to the _exported_ endpoint.
|
||||
|
||||
Streams and Services can be public; Public exports can be imported by any account. Or they can be private. Private streams and services require an authorization token from the exporting account that authorizes the foreign account to import the stream or service.
|
||||
|
||||
An importing account can remap the subject where a stream subscriber will receive messages or where a service requestor can make requests. This enables the importing account to simplify their subject space.
|
||||
|
||||
Exports and imports from an account are explicit, and they are visible in the account's JWT. For private exports, the import will embed an authorization token or a URL storing the token. Imports and exports make it easy to audit where data is coming from or going to.
|
||||
|
||||
## Configuration
|
||||
|
||||
Entity JWT configuration is done using the [`nsc` tool](../../../../nats-tools/nsc/README.md). The basic steps include:
|
||||
|
||||
* [Creation of an operator JWT](../../../../nats-tools/nsc/nsc.md#creating-an-operator)
|
||||
* [Configuring an Account Server](../../../../nats-tools/nsc/nsc.md#account-server-configuration)
|
||||
* [Setting up the NATS server to resolve Accounts](../../../../nats-tools/nsc/nsc.md#nats-server-configuration)
|
||||
|
||||
After that, [`nsc`](../../../../nats-tools/nsc/README.md) is used to create and edit accounts and users.
|
||||
|
||||
@@ -58,206 +58,3 @@ const nc = NATS.connect({
|
||||
```
|
||||
|
||||
The client provides a function that it uses to parse the seed \(the private key\) and sign the connection challenge.
|
||||
|
||||
## Mixing NKEYS and Trusted Operator setup in NATS v2
|
||||
|
||||
Mixing both nkeys static config and trusted operator setup (decentralized auth model) is possible
|
||||
but needs some preparation in order to be able to do it.
|
||||
|
||||
The way this can be done is by **first** preparing a basic trusted operator setup
|
||||
that could be used in the future, and then base from that configuration to create the
|
||||
NKEYS static config using the same shared public nkeys for the accounts and then use
|
||||
clustering routes to bridge the two different auth setups during the transition.
|
||||
|
||||
For example, creating the following initial setup using [NSC](../../../../nats-tools/nsc/README.md):
|
||||
|
||||
```sh
|
||||
nsc add account --name SYS
|
||||
nsc add user --name sys
|
||||
nsc add account --name A
|
||||
nsc add user -a A --name test
|
||||
nsc add account --name B
|
||||
nsc add user -a B --name test
|
||||
```
|
||||
|
||||
This will then generate something like the following:
|
||||
|
||||
```sh
|
||||
nsc list accounts
|
||||
╭─────────────────────────────────────────────────────────────────╮
|
||||
│ Accounts │
|
||||
├──────┬──────────────────────────────────────────────────────────┤
|
||||
│ Name │ Public Key │
|
||||
├──────┼──────────────────────────────────────────────────────────┤
|
||||
│ A │ ADFB2JXYTXOJEL6LNAXDREUGRX35BOLZI3B4PFFAC7IRPR3OA4QNKBN2 │
|
||||
│ B │ ACWOMQA7PZTKJSBTR7BF6TBK3D776734PWHWDKO7HFMQOM5BIOYPSYZZ │
|
||||
│ SYS │ ABKOWIYVTHNEK5HELPWLAT2CF2CUPELIK4SZH2VCJHLFU22B5U2IIZUO │
|
||||
╰──────┴──────────────────────────────────────────────────────────╯
|
||||
|
||||
nsc list users -a A
|
||||
╭─────────────────────────────────────────────────────────────────╮
|
||||
│ Users │
|
||||
├──────┬──────────────────────────────────────────────────────────┤
|
||||
│ Name │ Public Key │
|
||||
├──────┼──────────────────────────────────────────────────────────┤
|
||||
│ test │ UAPOK2P7EN3UFBL7SBJPQK3M3JMLALYRYKX5XWSVMVYK63ZMBHTOHVJR │
|
||||
╰──────┴──────────────────────────────────────────────────────────╯
|
||||
```
|
||||
|
||||
We could use this configuration as the initial starting configuration for an nkeys config now,
|
||||
where all the NKEYS users public nkeys are explicitly listed (centralized auth model).
|
||||
|
||||
```hcl
|
||||
port = 4222
|
||||
|
||||
cluster {
|
||||
port = 6222
|
||||
|
||||
# We will bridge two different servers with different auth models via routes
|
||||
# routes [ nats://127.0.0.1:6223 ]
|
||||
}
|
||||
|
||||
system_account = ABKOWIYVTHNEK5HELPWLAT2CF2CUPELIK4SZH2VCJHLFU22B5U2IIZUO
|
||||
|
||||
accounts {
|
||||
# Account A
|
||||
ADFB2JXYTXOJEL6LNAXDREUGRX35BOLZI3B4PFFAC7IRPR3OA4QNKBN2 {
|
||||
nkey: ADFB2JXYTXOJEL6LNAXDREUGRX35BOLZI3B4PFFAC7IRPR3OA4QNKBN2
|
||||
users = [
|
||||
{nkey: "UAPOK2P7EN3UFBL7SBJPQK3M3JMLALYRYKX5XWSVMVYK63ZMBHTOHVJR" }
|
||||
]
|
||||
}
|
||||
|
||||
# Account B
|
||||
ACWOMQA7PZTKJSBTR7BF6TBK3D776734PWHWDKO7HFMQOM5BIOYPSYZZ {
|
||||
}
|
||||
|
||||
# Account SYS
|
||||
ABKOWIYVTHNEK5HELPWLAT2CF2CUPELIK4SZH2VCJHLFU22B5U2IIZUO {
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
By using `nsc` it is possible to create a mem based resolver for the trusted operator setup:
|
||||
|
||||
```
|
||||
nsc generate config --mem-resolver --sys-account SYS
|
||||
```
|
||||
|
||||
An example configuration from the second node with the trusted operator setup could then be:
|
||||
|
||||
```hcl
|
||||
port = 4223
|
||||
|
||||
cluster {
|
||||
port = 6223
|
||||
routes [ nats://127.0.0.1:6222 ]
|
||||
}
|
||||
|
||||
# debug = true
|
||||
# trace = true
|
||||
|
||||
# Operator
|
||||
operator = eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJqdGkiOiJQNDJBSkFTVVA0TUdGRU1EQzVCRVVGUkM1MlQ1M05OTzRIWkhRNEdETVk0S0RZTFVRV0JBIiwiaWF0IjoxNTc0Mzc1OTE2LCJpc3MiOiJPQ09KSk5aSUNINkNHUU5LM1NRMzVXTFpXWkpDUkRBTFJIWjZPVzQ0RFpZVVdNVVYzV1BSSEZSRCIsIm5hbWUiOiJLTyIsInN1YiI6Ik9DT0pKTlpJQ0g2Q0dRTkszU1EzNVdMWldaSkNSREFMUkhaNk9XNDREWllVV01VVjNXUFJIRlJEIiwidHlwZSI6Im9wZXJhdG9yIiwibmF0cyI6e319.pppa9-xhWXJLSCCtqj_dqlvXKR7WlVCh0cqoZ6lr8zg3WlWM8U0bNf6FHw_67-wRS7jj0n4PuA0P0MAJdE3pDA
|
||||
|
||||
system_account = ABKOWIYVTHNEK5HELPWLAT2CF2CUPELIK4SZH2VCJHLFU22B5U2IIZUO
|
||||
|
||||
resolver = MEMORY
|
||||
|
||||
resolver_preload = {
|
||||
# Account "A"
|
||||
ADFB2JXYTXOJEL6LNAXDREUGRX35BOLZI3B4PFFAC7IRPR3OA4QNKBN2: eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJqdGkiOiIyQjNYNUJPQzQ3M05TU0hFWUVHTzJYRUhaTVNGRVBORFFBREJXWkJLRVdQVlg2TUlZU1JRIiwiaWF0IjoxNTc0Mzc1OTE2LCJpc3MiOiJPQ09KSk5aSUNINkNHUU5LM1NRMzVXTFpXWkpDUkRBTFJIWjZPVzQ0RFpZVVdNVVYzV1BSSEZSRCIsIm5hbWUiOiJBIiwic3ViIjoiQURGQjJKWFlUWE9KRUw2TE5BWERSRVVHUlgzNUJPTFpJM0I0UEZGQUM3SVJQUjNPQTRRTktCTjIiLCJ0eXBlIjoiYWNjb3VudCIsIm5hdHMiOnsiZXhwb3J0cyI6W3sibmFtZSI6InRlc3QiLCJzdWJqZWN0IjoidGVzdCIsInR5cGUiOiJzZXJ2aWNlIiwic2VydmljZV9sYXRlbmN5Ijp7InNhbXBsaW5nIjoxMDAsInJlc3VsdHMiOiJsYXRlbmN5Lm9uLnRlc3QifX1dLCJsaW1pdHMiOnsic3VicyI6LTEsImNvbm4iOi0xLCJsZWFmIjotMSwiaW1wb3J0cyI6LTEsImV4cG9ydHMiOi0xLCJkYXRhIjotMSwicGF5bG9hZCI6LTEsIndpbGRjYXJkcyI6dHJ1ZX19fQ.zZBetgDN6nCFDVpwzF_124BPkc8amGPDnrOmiKUa12xski5zskUI0Y0OeIa1vTo0bkHIKTgM2QDYpmXUQOHnAQ
|
||||
|
||||
# Account "B"
|
||||
ACWOMQA7PZTKJSBTR7BF6TBK3D776734PWHWDKO7HFMQOM5BIOYPSYZZ: eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJqdGkiOiJBTFNFQkZGWDZMR0pQTlVMU1NXTDNTRTNISkk2WUZSWlVKSDNLV0E1VE41WUtWRE5MVTJRIiwiaWF0IjoxNTc0Mzc1OTE2LCJpc3MiOiJPQ09KSk5aSUNINkNHUU5LM1NRMzVXTFpXWkpDUkRBTFJIWjZPVzQ0RFpZVVdNVVYzV1BSSEZSRCIsIm5hbWUiOiJCIiwic3ViIjoiQUNXT01RQTdQWlRLSlNCVFI3QkY2VEJLM0Q3NzY3MzRQV0hXREtPN0hGTVFPTTVCSU9ZUFNZWloiLCJ0eXBlIjoiYWNjb3VudCIsIm5hdHMiOnsiaW1wb3J0cyI6W3sibmFtZSI6InRlc3QiLCJzdWJqZWN0IjoidGVzdCIsImFjY291bnQiOiJBREZCMkpYWVRYT0pFTDZMTkFYRFJFVUdSWDM1Qk9MWkkzQjRQRkZBQzdJUlBSM09BNFFOS0JOMiIsInRvIjoidGVzdCIsInR5cGUiOiJzZXJ2aWNlIn1dLCJsaW1pdHMiOnsic3VicyI6LTEsImNvbm4iOi0xLCJsZWFmIjotMSwiaW1wb3J0cyI6LTEsImV4cG9ydHMiOi0xLCJkYXRhIjotMSwicGF5bG9hZCI6LTEsIndpbGRjYXJkcyI6dHJ1ZX19fQ.AnzziBwt5Tnphc2prONUUOpMpkkAlJHvCPaag0GUtTYPCHKDphcJrwtAHi4v5NOI6npjoes0F0MlrfnHqidDAg
|
||||
|
||||
# Account "SYS"
|
||||
ABKOWIYVTHNEK5HELPWLAT2CF2CUPELIK4SZH2VCJHLFU22B5U2IIZUO: eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJqdGkiOiI1WVUyWkc1UkRTSU1TN1pGVE1MU0NZQUtLVkVFWUpPUlc0TDJPTlY3N1g1TlJZWkFGSkRRIiwiaWF0IjoxNTc0Mzc1OTE2LCJpc3MiOiJPQ09KSk5aSUNINkNHUU5LM1NRMzVXTFpXWkpDUkRBTFJIWjZPVzQ0RFpZVVdNVVYzV1BSSEZSRCIsIm5hbWUiOiJTWVMiLCJzdWIiOiJBQktPV0lZVlRITkVLNUhFTFBXTEFUMkNGMkNVUEVMSUs0U1pIMlZDSkhMRlUyMkI1VTJJSVpVTyIsInR5cGUiOiJhY2NvdW50IiwibmF0cyI6eyJsaW1pdHMiOnsic3VicyI6LTEsImNvbm4iOi0xLCJsZWFmIjotMSwiaW1wb3J0cyI6LTEsImV4cG9ydHMiOi0xLCJkYXRhIjotMSwicGF5bG9hZCI6LTEsIndpbGRjYXJkcyI6dHJ1ZX19fQ.5FrO4sZbWuFgRLuy7c1eQLUq_BQ4PNhIAN5A-sRLkYWmvlc4c_Y4VfTbgl5zhNzCxfvj9SxT7ySgphup2BiRAA
|
||||
}
|
||||
```
|
||||
|
||||
Even though they have different authorization mechanisms, these two servers are able to route account messages because they share the same NKEY.
|
||||
|
||||
We have created at least one user, in this case with creds:
|
||||
|
||||
```conf
|
||||
-----BEGIN NATS USER JWT-----
|
||||
eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJqdGkiOiJNRkM3V1E1N0hKUE9aWUVOTEhVRTZTWFVQTDVKTURWSkxIQzJRTkpYNUVJS0RGR1U1REhRIiwiaWF0IjoxNTc0Mzc1OTE2LCJpc3MiOiJBREZCMkpYWVRYT0pFTDZMTkFYRFJFVUdSWDM1Qk9MWkkzQjRQRkZBQzdJUlBSM09BNFFOS0JOMiIsIm5hbWUiOiJ0ZXN0Iiwic3ViIjoiVUFQT0syUDdFTjNVRkJMN1NCSlBRSzNNM0pNTEFMWVJZS1g1WFdTVk1WWUs2M1pNQkhUT0hWSlIiLCJ0eXBlIjoidXNlciIsIm5hdHMiOnsicHViIjp7ImFsbG93IjpbIl9JTkJPWC5cdTAwM2UiLCJfUl8iLCJfUl8uXHUwMDNlIiwidGVzdCIsInRlc3QuXHUwMDNlIl19LCJzdWIiOnsiYWxsb3ciOlsiX0lOQk9YLlx1MDAzZSIsIl9SXyIsIl9SXy5cdTAwM2UiLCJsYXRlbmN5Lm9uLnRlc3QiLCJ0ZXN0IiwidGVzdC5cdTAwM2UiXX19fQ.MSU2aUIBK1iUsg7h52lLrfEfTwVMF_wB3HDq75ECskxSyyDDMtk9_3957UtQF-3yoGCIhKOkWjzX8C-WXnLADw
|
||||
------END NATS USER JWT------
|
||||
************************* IMPORTANT *************************
|
||||
NKEY Seed printed below can be used to sign and prove identity.
|
||||
NKEYs are sensitive and should be treated as secrets.
|
||||
-----BEGIN USER NKEY SEED-----
|
||||
SUANVBWRHHFMGHNIT6UJHPN2TGVBVIILE7VPVNEQ7DGCJ26ZD2V3KAHT4M
|
||||
------END USER NKEY SEED------
|
||||
*************************************************************
|
||||
```
|
||||
|
||||
And this same user is able to connect to either one of the servers (bound to 4222 and 4223 respectively):
|
||||
|
||||
Subscriber Service:
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"log"
|
||||
|
||||
"github.com/nats-io/nats.go"
|
||||
)
|
||||
|
||||
func main() {
|
||||
opts := make([]nats.Option, 0)
|
||||
|
||||
// Extract public nkey from seed
|
||||
//
|
||||
// Public: UAPOK2P7EN3UFBL7SBJPQK3M3JMLALYRYKX5XWSVMVYK63ZMBHTOHVJR
|
||||
// Private: SUANVBWRHHFMGHNIT6UJHPN2TGVBVIILE7VPVNEQ7DGCJ26ZD2V3KAHT4M
|
||||
//
|
||||
nkey, err := nats.NkeyOptionFromSeed("path/to/seed.nkey")
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
opts = append(opts, nkey)
|
||||
nc, err := nats.Connect("127.0.0.1:4222", opts...)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
nc.Subscribe("test", func(m *nats.Msg){
|
||||
log.Printf("[Received] %q, replying... \n", string(m.Data))
|
||||
m.Respond([]byte("pong from nkeys based server"))
|
||||
})
|
||||
|
||||
select {}
|
||||
}
|
||||
```
|
||||
|
||||
Requestor:
|
||||
|
||||
```go
|
||||
package main
|
||||
|
||||
import (
|
||||
"log"
|
||||
"time"
|
||||
|
||||
"github.com/nats-io/nats.go"
|
||||
)
|
||||
|
||||
func main() {
|
||||
nc, err := nats.Connect("127.0.0.1:4223", nats.UserCredentials("path/to/user.creds"))
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
for range time.NewTicker(1 * time.Second).C {
|
||||
resp, err := nc.Request("test", []byte("test"), 1*time.Second)
|
||||
if err != nil {
|
||||
log.Println("[Error]", err)
|
||||
continue
|
||||
}
|
||||
log.Println("[Received]", string(resp.Data))
|
||||
}
|
||||
}
|
||||
```
|
||||
Reference in New Issue
Block a user