ConnectEverything / ConnectEverything/nats-by-example
Verify Chain of Trust
- Dominant language
- Go
- Stars
- 207
- Forks
- 51
- PR merge metrics
- No merged PRs in 30d
Description
In an attempt to better understand the NATs ecosystem, I wanted to programmatically verify the Chain of Trust between the operator, account, and user JWTs. I am using the code below, I am happy to open a PR if this is a valuable example
```go
func main() {
resolverServer := "http://localhost:9090/jwt/v1"
claims, _ := jwt.Decode(userJWT) // userJWT provided by user
url := fmt.Sprintf("%s/accounts/%s", accountServer, claims.Claims().Issuer)
resp, _ := http.Get(url)
acctJWT, _ := ioutil.ReadAll(resp.Body)
resp.Body.Close()
url = fmt.Sprintf("%s/operator", accountServer)
resp, _ = http.Get(url)
opJWT, _ := ioutil.ReadAll(resp.Body)
resp.Body.Close()
opc, _ := jwt.DecodeOperatorClaims(string(opJWT))
acct, _ := jwt.Decode(string(acctJWT))
aopc, _ := jwt.DecodeAccountClaims(string(acctJWT))
// Does account JWT issuer match operator public key and did the operator public key sign the account JWT
if aopc.Issuer == opPub && opc.DidSign(acct) { // opPub -> operator public which is const at top of file
fmt.Println(aopc.DidSign(claims))
} else {
log.Fatal("chain of trust not valid")
}
log.Print("chain of trust verified")
}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start from the Go example in the issue and review the JWT endpoints for accounts and operators shown there. Verify how operator, account, and user JWTs are decoded and signed, then determine whether this should become a runnable NATS example. Done means the example programmatically verifies the chain of trust and reports failure when validation does not hold.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100