Auth callout python service

[jordanott]

I am trying to follow this example

I have a python flask server than grants a react client a jwt. I want to use that jwt to authenticate the nats client and authorize it to access certain subjects.

// after jwt is sent back from login it is put in localStorage
const authenticator = tokenAuthenticator(localStorage.getItem("jwt") as string);
const nc = await connect({ servers: "ws://127.0.0.1:9222/", authenticator: authenticator });

I am trying to authenticate that client using an auth callout service. The message is received but I get an authentication error after

import json
import asyncio
from nats.aio.client import Client as NATS

async def authenticate():
    nc = NATS()
    await nc.connect(servers=["nats://localhost:4222"], user="auth", password="auth")

    async def callback(msg):
        print(msg)
        claims = {
            "permissions": {"pub": [">"], "sub": [">"]},
        }
        await nc.publish(msg.reply, json.dumps(claims).encode())

    await nc.subscribe("$SYS.REQ.USER.AUTH", cb=callback)

asyncio.run(authenticate())

Here is the conf file

websocket {
  listen: 127.0.0.1:9222
  compression: true
  no_tls: true
  allowed_origins: ["http://localhost:3000"]
}

accounts {
  AUTH: {
    users: [ { user: auth, password: auth } ]
  }
  APP: {}
  SYS: {}
}
system_account: SYS

authorization {
  auth_callout {
    issuer: AA2WS5V5KIXTI26DFOT7DXSXHX3274WMESFPQ5FJSTR46G336WGVXUD4
    auth_users: [ auth ]
    account: AUTH
  }
}

[kaotika]

@jordanott Hi, most likely you need to build up a full response token. You can compare youre example to: #7136. I think it's the auth_response object.

[cfedersp]

Your response is string bytes containing the claims only. Also your input msg was never decoded - you're going to need the nats.user_nkey from that input object.

The response payload must contain your user claims, nested inside another json envelope. See examples below.
The inner block is first signed by a tenant account’s signing key, and “issuer_account” is required to specify the account the user belongs to and "iss" must point to its signing key to verify the signature with.
Finally, if the Auth Account is created with a "CurveKey" (aka "XKey"), that outer envelope must be encrypted with it - also if thats the case, the input object must be decrypted with that same key.

1. User Claim formatting
2. User Claims include:
   2.1) "iss" must reference the account signing key that will sign this inner object.
   2.2) “issuer_account” must reference the account identity.
3. User Claims must be signed by an account signing key (2.1 above)
4. Authorization Response Outer Envelope includes:
   4.1) "iss" must reference the auth account key that will sign this outer envelope.
   4.2) “issuer_account” must reference the auth account identity if “iss” isn’t the identity.
5. Optional Input Decryption and outer Envelope Encryption (can check Nats-Server-Xkey header to determine if this is configured)
   These require the Tenant Account’s Identity public key, the Account Signing key, the Auth Account’s Identity public key, and the Auth Account Signing key, and optionally the Curve key to be available to your auth-callout process.

Inner User Claims need to match the specific format of the AuthorizationResponseClaims object. Ex:
{
"sub": decoded_msg['nats']['user_nkey'],
"iss": "ATENANTACCOUNTSIGNINGKEYPUBLICKEYXXXXXXXXXXXXXXXXXXXXXXXX",
"issuer_account": "ATENANTACCOUNTIDENTITYKEYPUBLICKEYXXXXXXXXXXXXXXXXXXXXXXXX",
"iat": int(time.time()),
"nats": {
"pub": { "allow": [">"] },
"sub": { "allow": [">"] },
"type": "user",
"version": 2
}
}

Authorization Response (Outer Envelope):
{
"sub": decoded_msg['nats']['user_nkey'],
"aud": decoded_msg['nats']['server_id']['id'],
"iss": "AAUTHSIGNINGKEYPUBLICKEY_OR_AUTHIDENTITYPUBLICKEYGOESHEREXXX",
"issuer_account": "AAUTHIDENTITYPUBLICKEYGOESHEREXXXXXXXXXXXXXXXXXXXXXXXXXX",
"iat": int(time.time()),
"nats": {
"jwt": "<the encoded, signed inner user JWT above, as a string>",
"type": "authorization_response",
"version": 2
}
}