jesperancinha / your-finance-je

Using JWT in KumuluzEE. Two solutions are provided to understand how simple the JWT authentication/authorization system actually is.

Your Finance App

---

---

---

Introduction

Creation of one KumuluzEE App and with it investigate how the JWT token works.

This is the main project struture:

1. your-finance-banking - This is an extremely basic banking application that only performs a couple of functions
2. your-finance-jwt-generator - Java project that creates a JWT token. It is an alternative to project jwtenizr, by Adam Bien.
3. your-finance-k-jwt-generator - Kotlin project that creates a JWT token. It is an alternative to project jwtenizr, by Adam Bien.

This project is also the official support project of my article on medium:

Learning JWT security using KumuluzEE — The finances of a league of the environment

Stable releases

• 0.0.0 - 0bae454ebed482d6f1652bbc295c2b8b07bd1a20 - Java / JD17 / KumuluzEE
• 1.0.0 - ecd9d600f0ab265f343f3697f6f36a17a35f9aa6 - Kotlin 1.8.0 / JDK17 / KumuluzEE

How to run

There are many scripts available in the Makefile at the root of this project. However, the way to start this project and see all the aspects of it, it's better to just start the containers and open the cypress console;

1. Run command make dcup-full-action
2. Run cypress with make cypress-open

You can also run everything at once with make demo-action

Behind the scenes

Running the previous commands performs the following actions

1. Cleanup environment
2. Make a first Maven build to ensure that the JWT generator project is compiled
3. Creates AWS tokens using jwtenizr and your-finance-jwt-generator in separate locations:
   1. Start Generation Scripts
   2. Create User creation script: jwtenizr-files/createUser.sh and your-finance-files/createUser.sh
   3. Create Account creation script: jwtenizr-files/createAccount.sh and your-finance-files/createAccount.sh
   4. Create Send Money creation script: jwtenizr-files/sendMoney.sh and your-finance-files/sendMoney.sh
   5. Create Asks Credit script: jwtenizr-files/askCredit.sh and your-finance-files/askCredit.sh
4. Creates CSV to be used in Swagger tests;
   1. Name/JWT token pairs: jwtenizr-files/tokenNameValue.csv and your-finance-files/tokenNameValue.csv
5. Sets variables in config.yml
6. Makes new Maven build to create a running jar with the correct configuration
7. Copies both jars to separate foldersyour-finance-images
8. Starts both containers via your-finance-images/docker-compose.yaml
9. Runs cypress console

Generating Certificates

openssl req -new -newkey rsa:4096 -nodes -keyout yourfinance.key -out yourfinance.csr
openssl x509 -req -sha256 -days 365 -in yourfinance.csr -signkey yourfinance.key -out yourfinance.pem

References

• Eclipse MicroProfile JWT Authentication API
• MicroProfile JSON Web Token (JWT)
• JSON Web Token Claims
• Kumuluz Blog
• kumuluzEE
• REST API Security
• RESTful API Security
• Tutorial: Create and Verify JWTs in Java
• oktadeveloper/okta-java-jwt-example
• Spring Boot CLI
• Java EE Security API (JSR 375/Soteria) with JWT tokens
• payara/Payara-Examples
• Securing JAX-RS Endpoints with JWT
• Secure your application with Eclipse MicroProfile JWT Auth
• JWT Dispenser
• Configurable Token Expiration 4.0.0
• Microservices with KumuluzEE MicroProfile 1.2
• JWT authentication: When and how to use it
• The Ultimate Guide to handling JWTs on frontend clients (GraphQL)
• IANA JSON Web Token (JWT)
• CyberChef
• Using KumuluzEE Security
• A plain English introduction to JSON web tokens (JWT): what it is and what it isn’t
• Internet Engineering Task Force RFC7519

About me