Repository files navigation

JSON Web Token (JWT) Bearer Token Exchange Middleware forOAuth2orize.

This module exchanges a JWT for an access token after authenticated, asdefined by the JSON Web Token (JWT) Bearer Token Profiles for OAuth 2.0 draft. This module is modeled off of Google's OAuth 2.0Server to Server Applications. This module can be used with thepassport-oauth2-jwt-bearer module to create a JWT OAuth 2.0 exchange scenario server.

$ npm install oauth2orize-jwt-bearer

This exchange middleware is used to by clients to request an access token by using a JSON Web Token (JWT) generated by the client and verified by a Public Key stored on the OAuth 2.0 server. The exchange requires a verify callback, which accepts the client, JWT data and signature, then calls done providing a access token.

generate private keyopenssl genrsa -out private.pem 1024

abstract public keyopenssl rsa -in private.pem -out public.pem -outform PEM -pubout

sign the datasigning data: echo -n "data-to-sign" | openssl dgst -RSA-SHA256 -sign private.pem > signed

convert the signed file (binary) into base64 to be sent.base64 signed

varjwtBearer=require('oauth2orize-jwt-bearer').Exchange;server.exchange('urn:ietf:params:oauth:grant-type:jwt-bearer',jwtBearer(function(client,data,signature,done){varcrypto=require('crypto'),fs=require('fs')//load file system so you can grab the public key to read.,pub=fs.readFileSync('/path/to/public.pem').toString()//load PEM format public key as string, should be clients public key,verifier=crypto.createVerify("RSA-SHA256");//verifier.update takes in a string of the data that is encrypted in the signatureverifier.update(JSON.stringify(data));if(verifier.verify(pub,signature,'base64')){//base64url decode datavarb64string=data;varbuf=newBuffer(b64string,'base64').toString('ascii');// TODO - verify client_id, scope and expiration are valid from the buf variable aboveAccessToken.create(client,scope,function(err,accessToken){if(err){returndone(err);}done(null,accessToken);});}}));

$ npm install --dev$ make test

• bendiy

The MIT License

Copyright (c) 2012-2013 xTuple <http://www.xtuple.com/>