Support multiple JWT public keys (#395)

* Updated doc about existing JWT loading
* added support for additional pub key
* updated readme
* Updated version to 2.2.1
* Updated doc for pvt and pub key
* Added constants in NakshaHubConfig constructor
* addressed review comments

Author: hirenkp2000

README.md

@@ -103,9 +103,9 @@ java -jar <jar-file> <config-id> <database-url>
 
 # Example 1 : Start service with test config against default Database URL (useful for local env)
 java -jar build/libs/naksha-2.0.6-all.jar test-config
-# Example 2 : Start service with given custom config and custom database URL (useful for cloud env)
+# Example 2 : Start service with given custom config (using NAKSHA_CONFIG_PATH) and custom database URL (useful for cloud env)
 java -jar build/libs/naksha-2.0.6-all.jar cloud-config 'jdbc:postgresql://localhost:5432/postgres?user=postgres&password=pswd&schema=naksha&app=naksha_local&id=naksha_admin_db'
-# Example 3 : Start service with given custom config and default (local) database URL
+# Example 3 : Start service with given custom config (using NAKSHA_CONFIG_PATH) and default (local) database URL
 java -jar build/libs/naksha-2.0.6-all.jar custom-config
 
 ```
@@ -126,17 +126,16 @@ Once application is UP, the OpenAPI specification is accessible at `http(s)://{h
 The service persists out of modules with a bootstrap code to start the service. Service provides default configuration in [default-config.json](here-naksha-lib-hub/src/main/resources/config/default-config.json).
 
 The custom (external) configuration file can be supplied by modifying environment variable or by creating the `default-config.json` file in the corresponding configuration folder.
-The exact configuration folder is platform dependent, but generally follows the [XGD user configuration directory](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html), standard, so on Linux being by default `~/.config/naksha/v{x.x.x}/`. For Windows the files will reside in the [CSIDL_PROFILE](https://learn.microsoft.com/en-us/windows/win32/shell/csidl?redirectedfrom=MSDN) folder, by default `C:\Users\{username}\.config\naksha\v{x.x.x}\`.
-Here `{x.x.x}` is the Naksha application version (for example, if version is `2.0.7`, then path will be `...\.config\naksha\v2.0.7`)
+The exact configuration folder is platform dependent, but generally follows the [XGD user configuration directory](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html), standard, so on Linux being by default `~/.config/naksha/`. For Windows the files will reside in the [CSIDL_PROFILE](https://learn.microsoft.com/en-us/windows/win32/shell/csidl?redirectedfrom=MSDN) folder, by default `C:\Users\{username}\.config\naksha\`.
 
-Next to this, an explicit location can be specified via the environment variable `NAKSHA_CONFIG_PATH`, this path will not be extended by the `naksha/v{x.x.x}` folder, so you can directly specify where to keep the config files. This is important when you want to start multiple versions of the service: `NAKSHA_CONFIG_PATH=~/.config/naksha/ java -jar naksha.jar {arguments}`.
+Next to this, an explicit location can be specified via the environment variable `NAKSHA_CONFIG_PATH`, this path will not be extended by the `naksha/` folder, so you can directly specify where to keep the config files. This is important when you want to start multiple versions of the service: `NAKSHA_CONFIG_PATH=~/.config/naksha/ java -jar naksha.jar {arguments}`.
 
 In the custom config file, the name of the individual properties can be set as per source code here [NakshaHubConfig](here-naksha-lib-hub/src/main/java/com/here/naksha/lib/hub/NakshaHubConfig.java).
 All properties annotated with `@JsonProperty` can be set in custom config file.
 
 Config file is loaded using `{config-id}` supplied as CLI argument, as per following precedence on file location (first match wins):
 1. using env variable `NAKSHA_CONFIG_PATH` (full path will be `$NAKSHA_CONFIG_PATH/{config-id}.json`)
-2. as per user's home directory `user.home` (full path will be `{user-home}/.config/naksha/v{x.x.x}/{config-id}.json` )
+2. as per user's home directory `user.home` (full path will be `{user-home}/.config/naksha/{config-id}.json` )
 3. as per config previously loaded in Naksha Admin Storage (PostgreSQL database)
 4. default config loaded from jar (`here-naksha-lib-hub/src/main/resources/config/default-config.json`)
 
@@ -154,6 +153,21 @@ vi $NAKSHA_CONFIG_PATH/default-config.json
 java -jar naksha.jar default-config
 ```
 
+The config also accepts custom RSA256 Private key and multiple Public key files (in PEM format) to support JWT signing/verification operations.
+
+* If custom Private key not provided, default will be loaded from Jar bundled resource [here-naksha-app-service/src/main/resources/auth/jwt.key](here-naksha-app-service/src/main/resources/auth/jwt.key).
+* If custom Public key not provided, default will be loaded from Jar bundled resource [here-naksha-app-service/src/main/resources/auth/jwt.pub](here-naksha-app-service/src/main/resources/auth/jwt.pub).
+
+Sample commands to generate the custom key files:
+
+```bash
+# Generate private key
+openssl genrsa -out ./custom_rsa256.key 2048
+
+# Generate public key (using above private key)
+openssl rsa -in ./custom_rsa256.key -pubout -outform PEM -out ./custom_rsa256.pub
+```
+
 # Usage
 
 Start using the service by creating a _space_:

build.gradle.kts

@@ -158,7 +158,9 @@ subprojects {
             // excluding tests where Builder pattern gets broken by palantir
             targetExclude("src/test/**")
             encoding("UTF-8")
-            val YEAR = LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyy"))
+            // TODO - Disabling auto-correction to 2025 for now. Will handle via separate change.
+            //val YEAR = LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyy"))
+            val YEAR = 2024
             licenseHeader("""
 /*
  * Copyright (C) 2017-$YEAR HERE Europe B.V.

docker/Dockerfile

@@ -24,6 +24,7 @@ ENV NAKSHA_ADMIN_DB_URL 'jdbc:postgresql://host.docker.internal:5432/postgres?us
 ENV NAKSHA_EXTENSION_S3_BUCKET 'naksha-pvt-releases'
 ENV NAKSHA_JWT_PVT_KEY ''
 ENV NAKSHA_JWT_PUB_KEY ''
+ENV NAKSHA_JWT_PUB_KEY_2 ''
 ENV JAVA_OPTS ''
 
 # Execute Shell Script

docker/README.md

@@ -30,8 +30,9 @@ To get Naksha container running, one must do the following:
       use, `jdbc:postgresql://host.docker.internal:5432/postgres?user=postgres&password=password&schema=naksha&app=naksha_local&id=naksha_admin_db`
       by default
     - `NAKSHA_EXTENSION_S3_BUCKET`: S3 bucket name or S3 bucket access point.The default value is `naksha-pvt-releases`. 
-    - `NAKSHA_JWT_PVT_KEY`: Naksha JWT private key. If not provided then it will load it from `here-naksha-app-service/src/main/resources/auth/jwt.key`.
-    - `NAKSHA_JWT_PUB_KEY`: Naksha JWT public key. If not provided then it will load it from `here-naksha-app-service/src/main/resources/auth/jwt.pub`.
+    - `NAKSHA_JWT_PVT_KEY`: Naksha JWT private key.
+    - `NAKSHA_JWT_PUB_KEY`: Naksha JWT public key.
+    - `NAKSHA_JWT_PUB_KEY_2`: Additional Naksha JWT public key, if needed to validate the JWT signed by some other application's PVT key.
     - `JAVA_OPTS`: Any custom java options like `-Xms1024m -Xmx2048m`
 
    When connecting Naksha app to database, one has to consider container networking - if your
@@ -61,6 +62,7 @@ To get Naksha container running, one must do the following:
    --env NAKSHA_EXTENSION_S3_BUCKET=<your s3 bucket name or access point> \
    --env NAKSHA_JWT_PVT_KEY=<your naksha JWT private key with '\n' for new lines> \
    --env NAKSHA_JWT_PUB_KEY=<your naksha JWT public key with '\n' for new lines> \
+   --env NAKSHA_JWT_PUB_KEY_2=<some other application's JWT public key with '\n' for new lines> \
    --env JAVA_OPTS="-Xms1024m -Xmx2048m" \
    -p 8080:8080 \
    local-naksha-app

docker/cloud-config.json

@@ -1,11 +1,13 @@
 {
     "id": "cloud-config",
-    "type": "Config",
+    "type": "Feature",
     "httpPort": 7080,
     "requestBodyLimit": 25,
+    "authMode": "JWT",
+    "jwtPvtKeyPath":  "SOME_PVT_KEY_PATH",
+    "jwtPubKeyPaths": "SOME_PUB_KEY_PATHS",
     "maxParallelRequestsPerCPU": 100,
     "maxPctParallelRequestsPerActor": 25,
-    "authMode": "JWT",
     "extensionConfigParams": {
         "whitelistClasses": [ "java.*", "javax.*", "com.here.*", "jdk.internal.reflect.*", "com.sun.*", "org.w3c.dom.*", "sun.misc.*","org.locationtech.jts.*"],
         "intervalms": 30000,

docker/run-app.sh

@@ -3,13 +3,15 @@
 # Set the NAKSHA_CONFIG_PATH
 export NAKSHA_CONFIG_PATH=/home/naksha/app/config/
 
-# Replace placeholder in cloud-config.json
-sed -i "s+SOME_S3_BUCKET+${NAKSHA_EXTENSION_S3_BUCKET}+g" /home/naksha/app/config/cloud-config.json
+NAKSHA_PVT_KEY_PATH=""
+NAKSHA_PUB_KEY_PATHS=""
 
 # Check if NAKSHA_JWT_PVT_KEY is set and create jwt.key file if it is
 if [ -n "$NAKSHA_JWT_PVT_KEY" ]; then
     mkdir -p ${NAKSHA_CONFIG_PATH}auth/
-    echo "$NAKSHA_JWT_PVT_KEY" | sed 's/\\n/\n/g' > ${NAKSHA_CONFIG_PATH}auth/jwt.key
+    KEY_FILE_PATH=auth/jwt.key
+    echo "$NAKSHA_JWT_PVT_KEY" | sed 's/\\n/\n/g' > ${NAKSHA_CONFIG_PATH}${KEY_FILE_PATH}
+    NAKSHA_PVT_KEY_PATH=${KEY_FILE_PATH}
     echo "Using custom JWT private key"
 else
     echo "No custom JWT private key supplied"
@@ -18,11 +20,29 @@ fi
 # Check if NAKSHA_JWT_PUB_KEY is set and create jwt.pub file if it is
 if [ -n "$NAKSHA_JWT_PUB_KEY" ]; then
     mkdir -p ${NAKSHA_CONFIG_PATH}auth/
-    echo "$NAKSHA_JWT_PUB_KEY" | sed 's/\\n/\n/g' > ${NAKSHA_CONFIG_PATH}auth/jwt.pub
+    KEY_FILE_PATH=auth/jwt.pub
+    echo "$NAKSHA_JWT_PUB_KEY" | sed 's/\\n/\n/g' > ${NAKSHA_CONFIG_PATH}${KEY_FILE_PATH}
+    NAKSHA_PUB_KEY_PATHS=${KEY_FILE_PATH}
     echo "Using custom JWT public key"
 else
     echo "No custom JWT public key supplied"
 fi
 
+# Check if NAKSHA_JWT_PUB_KEY_2 is set and create jwt_2.pub file if it is
+if [ -n "$NAKSHA_JWT_PUB_KEY_2" ]; then
+    mkdir -p ${NAKSHA_CONFIG_PATH}auth/
+    KEY_FILE_PATH=auth/jwt_2.pub
+    echo "$NAKSHA_JWT_PUB_KEY_2" | sed 's/\\n/\n/g' > ${NAKSHA_CONFIG_PATH}${KEY_FILE_PATH}
+    NAKSHA_PUB_KEY_PATHS=${NAKSHA_PUB_KEY_PATHS},${KEY_FILE_PATH}
+    echo "Using custom JWT public key 2"
+else
+    echo "No custom JWT public key 2 supplied"
+fi
+
+# Replace all placeholders in cloud-config.json
+sed -i "s+SOME_S3_BUCKET+${NAKSHA_EXTENSION_S3_BUCKET}+g" /home/naksha/app/config/cloud-config.json
+sed -i "s+SOME_PVT_KEY_PATH+${NAKSHA_PVT_KEY_PATH}+g" /home/naksha/app/config/cloud-config.json
+sed -i "s+SOME_PUB_KEY_PATHS+${NAKSHA_PUB_KEY_PATHS}+g" /home/naksha/app/config/cloud-config.json
+
 # Start the application
 java $JAVA_OPTS -jar /home/naksha/app/naksha-*-all.jar $NAKSHA_CONFIG_ID $NAKSHA_ADMIN_DB_URL

gradle.properties

@@ -8,8 +8,7 @@ mavenUser=YourUserName
 mavenPassword=YourPassword
 
 # When updating the version, please as well consider:
-# - here-naksha-lib-core/NakshaVersion (static property: latest)
-# - here-naksha-lib-psql/resources/naksha_plpgsql.sql (method: naksha_version)
+# - here-naksha-lib-core/src/main/com/here/naksha/lib/core/NakshaVersion (static property: latest)
 # - here-naksha-app-service/src/main/resources/swagger/openapi.yaml (info.version property)
-version=2.2.0
+version=2.2.1
 

here-naksha-app-service/src/main/java/com/here/naksha/app/service/NakshaApp.java

@@ -102,13 +102,13 @@ private static void printUsage() {
     err.println("Examples:");
     err.println(" ");
     err.println("    Example 1 : Start service with given config and default (local) database URL");
-    err.println("        java -jar naksha.jar default-config");
+    err.println("        java -jar naksha.jar test-config");
     err.println(" ");
     err.println("    Example 2 : Start service with given config and custom database URL");
-    err.println("        java -jar naksha.jar default-config '" + DEFAULT_URL + "'");
+    err.println("        java -jar naksha.jar test-config '" + DEFAULT_URL + "'");
     err.println(" ");
-    err.println("    Example 3 : Start service with mock config (with in-memory hub)");
-    err.println("        java -jar naksha.jar mock-config");
+    err.println("    Example 3 : Start service with custom config (using custom NAKSHA_CONFIG_PATH)");
+    err.println("        java -jar naksha.jar custom-config");
     err.println(" ");
     err.flush();
   }
@@ -220,20 +220,20 @@ public NakshaApp(
     }
     this.vertx = Vertx.vertx(this.vertxOptions);
 
-    final String jwtKey;
-    final String jwtPub;
+    final List<PubSecKeyOptions> keyOptions = new ArrayList<>();
+    // read JWT pvt key
     {
-      final String path = "auth/" + config.jwtName + ".key";
-      jwtKey = readAuthKeyFile(path, NakshaHubConfig.APP_NAME);
+      final String keyContent = readAuthKeyFile(config.jwtPvtKeyPath, NakshaHubConfig.APP_NAME);
+      keyOptions.add(new PubSecKeyOptions().setAlgorithm("RS256").setBuffer(keyContent));
     }
-    {
-      final String path = "auth/" + config.jwtName + ".pub";
-      jwtPub = readAuthKeyFile(path, NakshaHubConfig.APP_NAME);
+    // read JWT pub keys
+    for (final String keyPath : config.jwtPubKeyPaths.split(",")) {
+      final String keyContent = readAuthKeyFile(keyPath, NakshaHubConfig.APP_NAME);
+      keyOptions.add(new PubSecKeyOptions().setAlgorithm("RS256").setBuffer(keyContent));
     }
     this.authOptions = new JWTAuthOptions()
         .setJWTOptions(new JWTOptions().setAlgorithm("RS256"))
-        .addPubSecKey(new PubSecKeyOptions().setAlgorithm("RS256").setBuffer(jwtKey))
-        .addPubSecKey(new PubSecKeyOptions().setAlgorithm("RS256").setBuffer(jwtPub));
+        .setPubSecKeys(keyOptions);
     this.authProvider = new NakshaAuthProvider(this.vertx, this.authOptions);
 
     final WebClientOptions webClientOptions = new WebClientOptions();

here-naksha-app-service/src/main/java/com/here/naksha/app/service/http/auth/NakshaJwtAuthHandler.java

@@ -44,7 +44,7 @@ public class NakshaJwtAuthHandler extends JWTAuthHandlerImpl {
   /**
    * The master JWT used for testing.
    */
-  private final String MASTER_JWT = authProvider.generateToken(MASTER_JWT_PAYLOAD);
+  private static String MASTER_JWT = null;
 
   public NakshaJwtAuthHandler(
       @NotNull JWTAuth authProvider, @NotNull NakshaHubConfig hubConfig, @Nullable String realm) {
@@ -57,6 +57,9 @@ public void authenticate(@NotNull RoutingContext context, @NotNull Handler<@NotN
     if (hubConfig.authMode == AuthorizationMode.DUMMY
         && !context.request().headers().contains(HttpHeaders.AUTHORIZATION)) {
       // Use the master JWT for testing in DUMMY auth mode with no JWT provided in request
+      if (MASTER_JWT == null) {
+        MASTER_JWT = authProvider.generateToken(MASTER_JWT_PAYLOAD);
+      }
       context.request().headers().set(HttpHeaders.AUTHORIZATION, "Bearer " + MASTER_JWT);
     }
     // TODO: If compressed JWTs are supported