使用自定义身份验证为 Cloud Endpoints 创建不记名令牌

Question

I'm trying to configure Cloud Endpoints as a front end for GKE. As part of such I'm manually trying to create a jwt. But when I try to use it as a bearer token I get the following response.

HTTP/1.1 401 Unauthorized
Connection: keep-alive
Content-Type: application/json
Date: Mon, 08 Feb 2021 16:28:06 GMT
Server: nginx
Transfer-Encoding: chunked
WWW-Authenticate: Bearer, error="invalid_token"

{
    "code": 16,
    "details": [
        {
            "@type": "type.googleapis.com/google.rpc.DebugInfo",
            "detail": "auth",
            "stackEntries": []
        }
    ],
    "message": "JWT validation failed: Bad JWT format: should have 2 dots"
}

I create a private and public key using openssl

openssl genrsa -out jwt-key 4096
openssl rsa -in jwt-key -pubout > jwt-key.pub

Then I use Python to create the JWT itself

import jwt
import datetime

private_key = open('jwt-key').read()
#public_key = open('jwt-key.pub').read()

aud = 'https://echo.api.some.com'
payload = {
    'iss': 'iss',
    'sub': 'sub',
    'aud': aud,
    'iat': datetime.datetime.utcnow(),
    'exp': datetime.datetime.utcnow() + datetime.timedelta(days=30)
}

token = jwt.encode(payload, private_key, algorithm='RS256')
print(token)

I use the output of the above Python script as argument to my http Authorization header

Authorization: Bearer $TOKEN

I have also uploaded the public key to a storage bucket and referenced that in my openapi specification but I'm pretty sure that's irrelevant in regards to my error.

Any clue about what I'm doing wrong?

Answer 1

Based on your comment and my comments from earlier:

The error that says Bad JWT format: should have 2 dots makes it look like the problem might be related to the token string itself. JWT strings should normally have two dots in them, and I think the format generally looks like this: header.payload.verify_signature according to the example on the jwt.io website .

If your token string doesn't have two dots in it, perhaps part of the token string is missing and might need to be regenerated using your script.

When I tried running your script on my side, I used the PyJWT module for the import jwt part and ran this on Python 3.6.5 on a Linux-based OS. After running the openssl commands you listed and then running your script, I ended up with a generated JWT string that has two dots within it.