ConnectEverything / ConnectEverything/nats-by-example

Verify Chain of Trust

Open
#101 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
207
Forks
51
PR merge metrics
No merged PRs in 30d

Description

In an attempt to better understand the NATs ecosystem, I wanted to programmatically verify the Chain of Trust between the operator, account, and user JWTs. I am using the code below, I am happy to open a PR if this is a valuable example

```go
func main() {
resolverServer := "http://localhost:9090/jwt/v1"

claims, _ := jwt.Decode(userJWT) // userJWT provided by user
url := fmt.Sprintf("%s/accounts/%s", accountServer, claims.Claims().Issuer)
resp, _ := http.Get(url)
acctJWT, _ := ioutil.ReadAll(resp.Body)
resp.Body.Close()

url = fmt.Sprintf("%s/operator", accountServer)
resp, _ = http.Get(url)
opJWT, _ := ioutil.ReadAll(resp.Body)
resp.Body.Close()

opc, _ := jwt.DecodeOperatorClaims(string(opJWT))

acct, _ := jwt.Decode(string(acctJWT))
aopc, _ := jwt.DecodeAccountClaims(string(acctJWT))

// Does account JWT issuer match operator public key and did the operator public key sign the account JWT
if aopc.Issuer == opPub && opc.DidSign(acct) { // opPub -> operator public which is const at top of file
fmt.Println(aopc.DidSign(claims))
} else {
log.Fatal("chain of trust not valid")
}
log.Print("chain of trust verified")
}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start from the Go example in the issue and review the JWT endpoints for accounts and operators shown there. Verify how operator, account, and user JWTs are decoded and signed, then determine whether this should become a runnable NATS example. Done means the example programmatically verifies the chain of trust and reports failure when validation does not hold.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.