[help needed]How to create account from operator with JAVA ?

[licheng5625]

Hi experts,
Is possible to create account by using java ? We would like to create a dedicate account and user, when a new tenant is getting on board .
We assume we need following steps:

1.   create a JWT of an acount 
   

2.   call $SYS.REQ.ACCOUNT.<account-id>.CLAIMS.UPDATE with the created JWT 
   

3.   create user's JWT 
   

Is this solution correct ?
if yes I have futher questions:

We can create a nkey for account:

NKey accountNey = NKey.createAccount(new SecureRandom());
char[] publicKey = accountNey.getPublicKey() ;   //AD7UONU43U2BAYJJW6T37IOTPS5YGZZCWDFPRCSHA6IUXFLZHXVJKGGW
char[] privateKey = accountNey.getPrivateKey() ;  //PACHPUHPIXL5IU6GWO75XWWISATLHDWIQCJUPDXGAGEDDMKSC2GDD72HG2ON2NAQMEU3PJ57UHJXZO4DM4RLBSXYRJDQPEKLSV4T32UVELQQ
char[] seed = accountNey.getSeed() ;    //SAAAI56Q55C5PVCTY2Z37W62ZCICNM4OZCAJGR4O4YAYQMNRKILIYMOCZI

But we are confused when we construct the JWT for account.

the decoded JWT of account looks like this :

{
  "jti": "some caculted value",
  "iat": 1633609679,
  "iss": "OXXXXXXXXXX",  // operator's signing key 
  "name": "MY NAME",
  "sub": "AXXXXXXXXXX",   // I guess it is the value of accountNey.getPublicKey() 
  "nats": {
    "limits": {
      "subs": -1,
      "data": -1,
      "payload": -1,
      "imports": -1,
      "exports": -1,
      "wildcards": true,
      "conn": -1,
      "leaf": -1,
      "mem_storage": -1,
      "disk_storage": -1,
      "streams": -1,
      "consumer": -1
    },
    "signing_keys": [
      "AXXXXXXXXXX".  
    ],
    "default_permissions": {
      "pub": {},
      "sub": {}
    },
    "type": "account",
    "version": 2
  }
}

How to fill in the sub and signing_keys fields ?

Is there any example ?

Thank and best regards
Cheng

[scottf]

I'm not exactly sure, but for now, do the JwtUtils help? https://github.com/nats-io/nats.java/blob/main/src/main/java/io/nats/client/support/JwtUtils.java

I don't know if the unit test will give more information either, but here it is: https://github.com/nats-io/nats.java/blob/main/src/test/java/io/nats/client/support/JwtUtilsTests.java

Also I suppose you've already read this: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro/jwt

[licheng5625]

I'm not exactly sure, but for now, do the JwtUtils help? https://github.com/nats-io/nats.java/blob/main/src/main/java/io/nats/client/support/JwtUtils.java

I don't know if the unit test will give more information either, but here it is: https://github.com/nats-io/nats.java/blob/main/src/test/java/io/nats/client/support/JwtUtilsTests.java

Also I suppose you've already read this: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro/jwt

Hi, thanks so much for your reply. The unit test and JWTUtils are helpful for creating a user. We are struggling with how to create an acount.
The different between creating account and user is, account' JWT contains a signing_key.

[licheng5625]

If there is anyone has same doubting as I had.
Please check the example I created https://github.com/licheng5625/NATS-Create-Account-User

[scottf]

@licheng5625 converted to discussion

[licheng5625]

If there is anyone has same doubting as I had.
Please check the example I created https://github.com/licheng5625/NATS-Create-Account-User