52 lines
1.7 KiB
Plaintext
52 lines
1.7 KiB
Plaintext
[#jwt-keys]
|
|
= JWT with Keys
|
|
|
|
include::partial$earlydoc.adoc[]
|
|
|
|
== Using Public Keys via JWKS
|
|
|
|
OliveTin Supports **JSON Web Key Sets (JWKS)**. This approach is often used with services like CloudFlare.
|
|
|
|
[source,yaml]
|
|
.`config.yaml`
|
|
----
|
|
authJwtAud: "asdf1234"
|
|
authJwtCertsURL: "https://mydomain.cloudflareaccess.com/cdn-cgi/access/certs"
|
|
authJwtClaimUsername: email
|
|
authJwtCookieName: "CF_Authorization"
|
|
----
|
|
|
|
You may well want to set `logLevel: DEBUG` and `insecureAllowDumpJwtClaims: true` in your config when testing JWT for the first time.
|
|
|
|
== Using with Teleport/Headers
|
|
|
|
If you are using Teleport, you can use the `authJwtCertsURL` to point to the Teleport JWKS.
|
|
|
|
Teleport can only https://goteleport.com/docs/enroll-resources/application-access/jwt/introduction/#inject-jwt[inject the JWT into a header], so you will need to set `authJwtHeader` to the header name that you have configured Teleport to use, e.g., `Authorization`.
|
|
|
|
|
|
[source,yaml]
|
|
.`config.yaml`
|
|
----
|
|
authJwtCertsURL: "https://teleport.mydomain/.well-known/jwks.json"
|
|
authJwtHeader: Authorization
|
|
----
|
|
|
|
Replace teleport.mydomain with the domain of your Teleport instance.
|
|
|
|
== Using Public Keys on Disk
|
|
|
|
This approach can be useful if your Authentication service does not support JWKS, or if you don't want to use it. Public Keys should be available on disk in a file - which can have any filename or extension you like. The files need to be RSA keys in PEM format to be used by OliveTin, though. P12 is not supported.
|
|
[source,yaml]
|
|
.`config.yaml`
|
|
----
|
|
authJwtAud: "asdf1234"
|
|
authJwtPubKeyPath: "/opt/mykey.crt"
|
|
authJwtClaimUsername: email
|
|
authJwtCookieName: "CF_Authorization"
|
|
----
|
|
|
|
== See Also
|
|
|
|
* xref:solutions/cloudflare_access_tunnel/index.adoc[Cloudflare Access & Tunnels Solution]
|