mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
Vladyslav SimonenkoandGitHub
3081343d68
## What changed? - Added `development-jwt.yaml` config that runs Temporal with JWT authorization enabled using a JWKS file loaded from local disk. Loading from local disk is added in https://github.com/temporalio/temporal/pull/9590. - Added `config/jwt/setup-keys.sh` to generate an RSA key pair and JWKS file in `/tmp/temporal-jwt-test/`. - Added `config/jwt/generate-token.sh` to create signed JWTs for testing. - Added `make start-jwt` target. ## Why? Testing JWT authentication currently requires an external identity provider or manual key/token setup. This provides a self-contained local workflow: `make start-jwt` generates keys automatically and starts the server with auth enforced, and `generate-token.sh` produces tokens on demand. ## How did you test it? - [X] built - [X] run locally and tested manually - [ ] covered by existing tests - [ ] added new unit test(s) - [ ] added new functional test(s) Tested this in conjunction with https://github.com/temporalio/temporal/pull/9582. Was able to list the workflows by passing the token and dumping their history. When the token is not used, the auth fails with "Request denied". ## Potential risks Keys are stored in /tmp/temporal-jwt-test/ which is world-readable. This is acceptable for local development but the scripts should not be used in shared or production environments.
56 lines
1.3 KiB
Bash
Executable File
56 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Generate RSA key pair and JWKS for local JWT testing
|
|
# This script is idempotent - it only generates keys if they don't exist
|
|
|
|
set -euo pipefail
|
|
|
|
KEY_DIR="/tmp/temporal-jwt-test"
|
|
PRIVATE_KEY="$KEY_DIR/private-key.pem"
|
|
JWKS_DIR="$KEY_DIR/.well-known"
|
|
JWKS_FILE="$JWKS_DIR/jwks.json"
|
|
|
|
mkdir -p "$JWKS_DIR"
|
|
|
|
# Generate private key if it doesn't exist
|
|
if [ ! -f "$PRIVATE_KEY" ]; then
|
|
echo "Generating RSA private key..."
|
|
openssl genrsa -out "$PRIVATE_KEY" 2048 2>/dev/null
|
|
# Remove JWKS so it gets regenerated with the new key
|
|
rm -f "$JWKS_FILE"
|
|
fi
|
|
|
|
# Generate JWKS from private key if it doesn't exist
|
|
if [ ! -f "$JWKS_FILE" ]; then
|
|
echo "Generating JWKS from private key..."
|
|
|
|
# Extract modulus in hex
|
|
MODULUS_HEX=$(openssl rsa -in "$PRIVATE_KEY" -noout -modulus 2>/dev/null | cut -d= -f2)
|
|
|
|
# Convert hex to binary, then to base64url
|
|
N=$(echo "$MODULUS_HEX" | xxd -r -p | base64 | tr '+/' '-_' | tr -d '=' | tr -d '\n')
|
|
|
|
# RSA public exponent is typically 65537 = 0x010001
|
|
# In base64url: AQAB
|
|
E="AQAB"
|
|
|
|
cat > "$JWKS_FILE" << EOF
|
|
{
|
|
"keys": [
|
|
{
|
|
"kty": "RSA",
|
|
"kid": "test-key-1",
|
|
"use": "sig",
|
|
"alg": "RS256",
|
|
"n": "$N",
|
|
"e": "$E"
|
|
}
|
|
]
|
|
}
|
|
EOF
|
|
echo "Created $JWKS_FILE"
|
|
fi
|
|
|
|
echo "Keys ready:"
|
|
echo " Private key: $PRIVATE_KEY"
|
|
echo " JWKS file: $JWKS_FILE"
|