Requesting-an-access-token-with-a-jwt - SOLVED
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 06:32 AM
Hi people,
According Oauth2 FLOW https://doc.nuxeo.com/nxdoc/using-oauth2/#requesting-an-access-token-with-a-jwt,
I tried to get access token by testing Access Token with a JWT with my Postman but I have some exceptions server side.
Here How I declared Oauth2 client serveur side :
Here is My Postman
Here is the server logs
2019-04-05T12:14:44,334 ERROR [https-jsse-nio-0.0.0.0-8443-exec-3] [nuxeo-error-log] javax.servlet.ServletException: java.lang.NullPointerException
at org.nuxeo.ecm.platform.web.common.requestcontroller.filter.NuxeoRequestControllerFilter.doFilter(NuxeoRequestControllerFilter.java:145)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:209)
at com.thetransactioncompany.cors.CORSFilter.doFilter(CORSFilter.java:244)
Caused by: java.lang.NullPointerException
at org.nuxeo.ecm.platform.oauth2.NuxeoOAuth2Servlet.doPostToken(NuxeoOAuth2Servlet.java:358)
at org.nuxeo.ecm.platform.oauth2.NuxeoOAuth2Servlet.doPost(NuxeoOAuth2Servlet.java:121)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
Thanks for help
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:00 AM
Please read my previous comment below
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:06 AM
Here is TRACE
of JWTServiceImpl
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:12 AM
Do you generate the token with Nuxeo? Cause Nuxeo uses only HMAC512 algorithm to generate jwt tokens and regarding the error you get it's not the algorithm used in your jwt token.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:31 AM
There's no customisation on this part inside Nuxeo. We use HmacSHA512
algorithm (HS512
) to generate and verify tokens, you need to generate a JWT token with this algorithm and the nuxeo
issuer in the claim (iss
).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:32 AM
It would be interesting to add a new parameter in nuxeo.conf
like nuxeo.jwt.alg = HS256 | HS384 | HS512
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:33 AM
My jwt use HS256
Algorithm and shared secret base64 encoded
, see in https
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:35 AM
We see no reason to allow weaker algorithms.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-05-2019 09:42 AM
I think it's the responsibility to users to use weaker or strong algorithms. I this case, We must update all our APIS to fit in nuxeo strategy. Users can have choice to update later their app
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-15-2019 08:16 AM
Hi [Kevin Leturc](https
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎04-15-2019 10:50 AM
Hi,
