Giters

SkyLothar / lua-resty-jwt

JWT For The Great Openresty

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Pem from JWKS

venkatmarepalli opened this issue · comments

commented

Can you add this piece of code to this library. This gets PEM key from JWT token using n and e. It also supports pem Generation using x5c.

Refer:
zmartzone/lua-resty-openidc#71

Code:
https://github.com/pingidentity/lua-resty-openidc/pull/82/files

commented

👍 👍 👍 They had me time crunched at work so I ended up making this to call straight into cjose and perform proper jws / jwk validation

commented

One alternate avenue is using something like this in aws lambda to transform the key so I could use it with this library

var jwkToPem = require('jwk-to-pem');
var request = require ('request');
var Promise = require('bluebird');
var openssl = require('openssl-wrapper');
const opensslAsync = Promise.promisify(openssl.exec);
const fs = require('fs');
exports.main = (params) => {
  const url = KEYURL;
  return new Promise((resolve, reject) => {
    request.get(url, (err, res, body) => {
      var key = JSON.parse(body);
      key.use = 'sig';                                                                                                                                                                                        
      if (err)
        reject(err);
      fs.writeFileSync('./key.pem', jwkToPem(key));
      return opensslAsync('rsa', {inform: 'pem', in: './key.pem', pubout: true, RSAPublicKey_in: true})
      .then((data) => {
        resolve({msg: data.toString()});
      })  
      .catch((err) => {
        reject({err: err});
      })  
    })  
  })  
}

Recognize how difficult it may be to do a full implementation of JOSE in lua.. without luajit ffi and cjose wouldn't have made this deliverable

commented

Many Thanks. I will look into it, which library are you using for jwkToPem(key). Can you point me to this function's source?

commented

You can just use my lua-resty-cjose.. cisco/cjose can handle keys in plain jwk format as long as they are converted to a c string (which my library does).. That way you can do it inside of openresty.. If you look at how I built it into our apigateway here I use lua code to call into the library after grabbing the jwk and do all the proper validation / introspection.. you do need libcjose on the LD_LIBRARY_PATH though