jwt-grant-generator

KO | EN

gitlite — search

#javascript #hacktoberfest #typescript #golang #go #android #machine-learning #rust #macos #awesome #kubernetes #security #mcp #open-source

jwt-grant-generator

(★ 20)

Example code in java on how to generate jwt-grants used to retrieve tokens for accessing Maskinporten protected APIs

jwt-grant-generator Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# jwt-grant-generator

This project demonstrates how clients of Maskinporten can make a jwt grant used to retrieve tokens for accessing services like Kontakt- og reservasjonsregisteret REST-API or ID-porten self-service APIs.

Before you can retrieve any tokens you need to be a customer of Digdir and have a client registration, see https://samarbeid.digdir.no

It is important to understand the authorization flow used for these apis, see https://docs.digdir.no/docs/Maskinporten/maskinporten_guide_apikonsument

Note: The access token is only retrieved if an token.endpoint property is given. Without this a jwt bearer grant will only be printed.

For questions, please contact servicedesk@digdir.no

### Client configuration
To generate a jwt-grant you need a property file holding your client configuration:

```
issuer=<Your client_id>
audience=<Identifier of the Maskinporten instance you want to use, i.e. for test env:  https://test.maskinporten.no/>
resource=<The intended audience for token. If included, the value will be transparantly set as the aud-claim in the access token>
scope=<scopes to request access for (space delimited list), i.e. for id-porten self service api use: idporten:dcr.read idporten:dcr.write>

keystore.type=<keystore type, default is JKS>
keystore.file=<path to your keystore file holding your virksomhetssertifikat / keypair, or base64-encoded keystore>
keystore.password=<keystore password>
keystore.alias=<alias for your virksomhetssertifikat's key>
keystore.alias.password=<alias password>

authorization_details.<auth_detail_index>.type=urn:altinn:systemuser
authorization_details.<auth_detail_index>.systemuser_org.ID=0192:<system_org_no>
authorization_details.<auth_detail_index>.systemuser_org.authority=iso6523-actorid-upis
```

To use base64-encoded keystore, use:

```
keystore.file=base64:/u3+7QAAAAIAAAADAAAAAQAPY29tbWZp...
```

To also retrieve an access-token from an authorization server, add this property to the properties file:

```
token.endpoint=<Token endpoint to use, i.e. in test env: https://test.maskinporten.no/token>
```

If you want to generate a token utilising the delegation capabilities in Maskinporten, add this property to the properties file:
```
consumer_org=<the orgnumber of the consumer that has delegated the access>
```

You may authenticate with a self-signed certificate if your client in Maskinporten holds a JSON Web Key Set with your public key, simply add your key ID to the properties file:
```
keystore.kid=<guid to key id used in Maskinporten client jwks>
```

Authorization details will be decoded, and can contain more than one, so that each <auth_detail_index> makes a separate authorization_details. Using sub-values (like systemuser_org) creates sub object in jwt, the example config above will be included like this:
```json
{
  ...
  "authorization_details" : [ {
    "type" : "urn:altinn:systemuser",
    "systemuser_org" : {
      "ID" : "0192:<systerm_org_no>",
      "authority" : "iso6523-actorid-upis"
    }
  } ],
  ...
}
```

## Usage

To build and run use:

```
mvn package

java -jar target\jwt-grant-generator-1.1.0-SNAPSHOT-jar-with-dependencies.jar myclient.properties

```

### Output as JSON
If you want the response as json, you can add an additional parameter so the command to build and run is
```
mvn package

java -jar target\jwt-grant-generator-1.1.0-SNAPSHOT-jar-with-dependencies.jar myclient.properties json

```

The JSON will be a single line so it is easy to capture in a script and can then be parsed with tools like jq.
A pretty representation of the JSON schema is
```
{
    "grant": "...",
    "token": {
        "access_token": "...",
        "token_type": "Bearer",
        "expires_in": 7199,
        "scope": "..."
    }
}

```

jwt-grant-generator

jwt-grant-generator Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

jwt-grant-generator

jwt-grant-generator Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README