OAuth2 service tokens

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
using Microsoft.IdentityModel.Tokens;
using Org.BouncyCastle.OpenSsl;  // nuget package "BouncyCastle"
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;  // nuget package "System.IdentityModel.Tokens.Jwt"
using System.Security.Claims;
using System.Security.Cryptography;
using System;

namespace JwtCredential
{
    class JwtCredentialCreator
    {
        /// <summary>Generates the credential JWT used by accesso's tokens API
        ///          to authenticate a service account.</summary>
        /// <param name="clientId">client ID of the service account.</param>
        /// <param name="authServerHost">FQDN of the authorization service.</param>
        /// <param name="pathToPemFile">Path to the PEM file containing the private key.</param>
        /// <returns>JWT credential.</returns>
        static string CreateCredential(
            string clientId,
            string authServerHost,
            string pathToPemFile
        )
        {
            // Read in the PEM file and convert into a SecurityKey
            // which may be used to sign the JWT.
            var readFile = new System.IO.StreamReader(pathToPemFile);
            var pemObject = new PemReader(readFile).ReadPemObject();
            var provider = new RSACryptoServiceProvider();
            provider.ImportRSAPrivateKey(
                new ReadOnlySpan<byte>(pemObject.Content),
                out int bytesRead
            );
            var rsaSecurityKey = new RsaSecurityKey(provider);

            // The JWT library requires credentials to sign the JWT.
            // We will use the SecurityKey we just created.
            var signingCredentials = new SigningCredentials(
                    rsaSecurityKey,
                    SecurityAlgorithms.RsaSha256
            );

            // Current timestamp in UTC.
            var now = DateTime.UtcNow;

            // Anything outside of the standard set of JWT fields must be declared as "claims".
            var claims = new List<Claim>();

            // Create a TokenDescriptor holding all the details of the payload of the token.
            // This will be used by the TokenHandler to generate the token.
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                IssuedAt = now,
                NotBefore = now,
                Expires = now.AddDays(1),
                Issuer = clientId,
                Audience = "https://" + authServerHost,
                Subject = new ClaimsIdentity(claims),
                SigningCredentials = signingCredentials
            };

            // Use the TokenDescriptor to create the JWT.
            var handler = new JwtSecurityTokenHandler();
            var token = handler.CreateJwtSecurityToken(tokenDescriptor);

            // Convert the JWT object to a string and return it.
            return handler.WriteToken(token);
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# Service account information and token lifetime.
client_id    <- "my.oauth2.client_id"
authSvrFQDN  <- "api.us.te2.io"
private_key  <- "MIIEvgIB"
scopes       <- "read write"
time_to_live <- 86000

# Construct the account's credential.
account_credential <- create_credential(
    account_id,
    authSvrFQDN,
    private_key,
    time_to_live
)

# Fetch the token.
token_response <- execute_curl(
    method  <- 'POST',
    url     <- 'https://api.{region}.te2.io/oauth2/token',
    headers <- {
                    "Cache-Control" : "no-cache",
                    "Content-Type"  : "application/json"
               }
    parameters <- {
                   :grant_type             : "client_credentials"
                   "client_id"             : client_id,
                   "client_assertion_type" : "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
                   "credential"            : account_credential
                   "scopes"                : scopes,
               }
)

# Extract the service token from the response.
access_token <- token_response.access_token

# Use the service token to make a call.
generic_endpoint_response <- execute_curl(
    method  <- 'GET'
    url     <- 'https://api.region.te2.io/v1/some/generic/endpoint'
    headers <- {
                    "Cache-Control" : "no-cache",
                    "Content-Type"  : "application/json"
                    "Authorization" : "Bearer " + access_token
                }
)