Requesting-an-access-token-with-a-jwt - SOLVED

[freemann_]

Hi people,

According Oauth2 FLOW https://doc.nuxeo.com/nxdoc/using-oauth2/#requesting-an-access-token-with-a-jwt, I tried to get access token by testing Access Token with a JWT with my Postman but I have some exceptions server side. Here How I declared Oauth2 client serveur side :

Here is My Postman

Here is the server logs

2019-04-05T12:14:44,334 ERROR [https-jsse-nio-0.0.0.0-8443-exec-3] [nuxeo-error-log] javax.servlet.ServletException: java.lang.NullPointerException
	at org.nuxeo.ecm.platform.web.common.requestcontroller.filter.NuxeoRequestControllerFilter.doFilter(NuxeoRequestControllerFilter.java:145)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:209)
	at com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:244)
	Caused by: java.lang.NullPointerException
	at org.nuxeo.ecm.platform.oauth2.NuxeoOAuth2Servlet.doPostToken(NuxeoOAuth2Servlet.java:358)
	at org.nuxeo.ecm.platform.oauth2.NuxeoOAuth2Servlet.doPost(NuxeoOAuth2Servlet.java:121)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)

Thanks for help

[Kevin_Leturc]

Please read my previous comment below

[freemann_]

Here is TRACE of JWTServiceImpl

[Kevin_Leturc]

Do you generate the token with Nuxeo? Cause Nuxeo uses only HMAC512 algorithm to generate jwt tokens and regarding the error you get it's not the algorithm used in your jwt token.

[Kevin_Leturc]

There's no customisation on this part inside Nuxeo. We use HmacSHA512 algorithm (HS512) to generate and verify tokens, you need to generate a JWT token with this algorithm and the nuxeo issuer in the claim (iss).

[freemann_]

It would be interesting to add a new parameter in nuxeo.conf like nuxeo.jwt.alg = HS256 | HS384 | HS512

[freemann_]

My jwt use HS256 Algorithm and shared secret base64 encoded, see in https

[Florent_Guillau]

We see no reason to allow weaker algorithms.

[freemann_]

I think it's the responsibility to users to use weaker or strong algorithms. I this case, We must update all our APIS to fit in nuxeo strategy. Users can have choice to update later their app

[freemann_]

Hi [Kevin Leturc](https

[freemann_]

Hi,