JWT Authentication - Service Request MSF

JWT signature is used to verify whether the token is signed by the sender and not altered. The signature is created by using the Header and Payload segments, a signing algorithm, and a secret or public key.

To enable JWT Authorization set msms.security.tokencheck.enabled as Y.

Properties	Description
JWT_TOKEN_ISSUER	Identifies the issuer of the authentication token.
JWT_TOKEN_PUBLIC_KEY	Indicates Base64 encoded public key content that can be directly loaded as a public key certificate.
JWT_TOKEN_PRINCIPAL_CLAIM	Indicates the claim in which the user principal is provided.
ID_TOKEN_SIGNED	Enables the JWT signature validation along with the header and payload.

Deployment

This section contains information about deploying the WAR file to the following stacks:

• Docker
• J2EE
• AWS
• Azure

Docker

To deploy Docker, set the following JWT configuration properties as Environment Variables in the API container of ms-arrangement.yml and ms-servicerequest.yml.

#--- JWT & XACML PDP Configuration ---
temn.msf.security.authz.enabled: "false"
PDP_CONFIG: classpath:xacml/holdings-pdp-config.xml
temn.msf.pdp.resource.type: API
temn.msf.pdp.resource.manager: HOLDING
ms.security.tokencheck.enabled: N
# To validate the JWT token with Entitlement MS, userId should be present in Entitlement MS with roleId used in XACML policy and
# temn.entitlement.service.enabled should be set to "true"
temn.entitlement.service.enabled: "false"
temn.entitlement.service.base.path: http://localhost:8095/ms-entitlement-api/api/v1.0.0
temn.entitlement.service.resource.path: system/entitlements/users/{userId}/roles
temn.entitlement.stubbed.service.enabled: "false"
#If Entitlement MS is deployed on AWS/Azure, pass the API key in below variable
temn.entitlement.service.api.key: <x-api-key here>
ID_TOKEN_SIGNED: "false"
JWT_TOKEN_ISSUER: Fabric
JWT_TOKEN_PRINCIPAL_CLAIM: FABRICUSER

J2EE

Configure the following JWT configurations in api.properties:

#--- JWT & XACML PDP Configuration ---
temn.msf.security.authz.enabled=true
PDP_CONFIG=classpath:xacml/holdings-pdp-config.xml
temn.msf.pdp.resource.type=API
temn.msf.pdp.resource.manager=HOLDING
ms.security.tokencheck.enabled=Y
# To validate the JWT token with Entitlement MS, userId should be present in Entitlement MS with roleId used in XACML policy and
# temn.entitlement.service.enabled should be set to "true"
temn.entitlement.service.enabled=false
temn.entitlement.service.base.path=http://localhost:8095/ms-entitlement-api/api/v1.0.0
temn.entitlement.service.resource.path=system/entitlements/users/{userId}/roles
#If Entitlement MS is deployed on AWS/Azure, pass the API key in below variable
temn.entitlement.service.api.key=<x-api-key here>
temn.entitlement.stubbed.service.enabled=false
ID_TOKEN_SIGNED=false
JWT_TOKEN_ISSUER=Fabric
JWT_TOKEN_PRINCIPAL_CLAIM=FABRICUSER

AWS

Configure the following JWT configurations in install-aws.sh:

# --- JWT & XACML PDP Configuration ---
export temn_msf_security_authz_enabled="true"
export PDP_CONFIG="classpath:xacml/pdp-config.xml"
export temn_msf_pdp_resource_type="API"
export temn_msf_pdp_resource_manager="SERVICEREQUEST"
export ms_security_tokencheck_enabled="Y"
# To validate the JWT token with Entitlement MS, userId should be present in Entitlement MS with roleId used in XACML policy and
#,temn_entitlement_service_enabled should be export to "true"
export temn_entitlement_service_enabled="false"
export temn_entitlement_service_base_path="http://localhost:8095/ms-entitlement-api/api/v1.0.0"
export temn_entitlement_service_resource_path=\"/system/entitlements/user/{userId}/roles\"
# If Entitlement MS is deployed on AWS/Azure, pass the API key in below variable
export temn_entitlement_service_api_key="<>"
export temn_entitlement_stubbed_service_enabled="false"
export ID_TOKEN_SIGNED="false"
export JWT_TOKEN_ISSUER="Fabric"
export JWT_TOKEN_PRINCIPAL_CLAIM="FABRICUSER"

Azure

Configure the following JWT configurations in azure/install.bat, and then in azure/install.sh.

azure/install.bat:

REM --- JWT & XACML PDP Configuration ---
SET temn_msf_security_authz_enabled="false"
SET PDP_CONFIG="classpath:xacml/pdp-config.xml"
SET temn_msf_pdp_resource_type="API"
SET temn_msf_pdp_resource_manager="SERVICEREQUEST"
SET ms_security_tokencheck_enabled="Y"
REM To validate the JWT token with Entitlement MS, userId should be present in Entitlement MS with roleId used in XACML policy and
REM temn_entitlement_service_enabled should be set to "true"
SET temn_entitlement_service_enabled="true"
SET temn_entitlement_service_base_path="http://localhost:8095/ms-entitlement-api/api/v1.0.0"
SET temn_entitlement_service_resource_path="system/entitlements/users/{userId}/roles"
REM If Entitlement MS is deployed on AWS/Azure, pass the API key in below variable
SET temn_entitlement_service_api_key="<x-api-key here>"
SET temn_entitlement_stubbed_service_enabled="false"
SET ID_TOKEN_SIGNED="false"
SET JWT_TOKEN_ISSUER="Fabric"
SET JWT_TOKEN_PRINCIPAL_CLAIM="FABRICUSER"

azure/install.sh:

# --- JWT & XACML PDP Configuration ---
export temn_msf_security_authz_enabled="true"
export PDP_CONFIG="classpath:xacml/pdp-config.xml"
export temn_msf_pdp_resource_type="API"
export temn_msf_pdp_resource_manager="SERVICEREQUEST"
export ms_security_tokencheck_enabled="Y"
# To validate the JWT token with Entitlement MS, userId should be present in Entitlement MS with roleId used in XACML policy and
# temn_entitlement_service_enabled should be export to "true"
export temn_entitlement_service_enabled="false"
export temn_entitlement_service_base_path="http://localhost:8095/ms-entitlement-api/api/v1.0.0"
export temn_entitlement_service_resource_path="system/entitlements/users/{userId}/roles"
# If Entitlement MS is deployed on AWS/Azure, pass the API key in below variable
export temn_entitlement_service_api_key="<x-api-key here>"
export temn_entitlement_stubbed_service_enabled="false"
export ID_TOKEN_SIGNED="false"
export JWT_TOKEN_ISSUER="Fabric"
export JWT_TOKEN_PRINCIPAL_CLAIM="FABRICUSER"