Re: JWT (was: Upcoming Spring 2021 RPG enhancements)

So add it to the current code in ILeastic!

I'd have done it myself had I had the need and right now I have other priorities. The rest of the JWT routines should still be good - it is surely only the encryption that needs to be added.


Jon

On Apr 20, 2021, at 1:04 PM, Charles Wilt <charles.wilt@xxxxxxxxx> wrote:

Yes, ILeastic supports HS256 (HMAC using SHA256).

But not RS256 (RSA using SHA256).

The problem is that HS256 is a shared secret, and

Sharing the HMAC secret with a third-party service creates a significant
vulnerability. Even sharing the secret between different services within a
single architecture is not recommended. If all services share the same key,
the compromise of a single service immediately becomes an architecture-wide
problem.

For simple stuff, it's fine, but once you have a separate authentication
server and numerous secured resources, RS256 is the way to go.

Charles

On Tue, Apr 20, 2021 at 10:41 AM Jon Paris <jon.paris@xxxxxxxxxxxxxx> wrote:

"While nodejs web-services on the i could validate them, IWS or other RPG
ones currently can not."

Agreed that IWS can't - although I believe it is high on their wish list.
But as noted yesterday ILeastic offers routines for one "flavour" and I use
them in my RPG routines that talk to Zoom APIs.


Jon Paris

On Apr 20, 2021, at 12:37 PM, Charles Wilt <charles.wilt@xxxxxxxxx>

wrote:

On Tue, Apr 20, 2021 at 9:35 AM Tim Fathers <tim@xxxxxxxxxxxxx> wrote:

I'm curious as to why you'd want to use JWTs (unless you're having to
consume them somehow), their use case seems to be fairly limited and not
particularly suitable to systems of our scale.

Huh? I don't understand where you'd get that idea.

JSON Web Tokens (JWT) are an open, industry standard RFC 7519 method for
representing claims securely between two parties.

The rest of the world uses JWTs to among other things secure the APIs

they

are building. The API is one side and the other is your selected

identity

provider.

While nodejs web-services on the i could validate them, IWS or other RPG
ones currently can not.

Charles
--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription

related questions.

Help support midrange.com by shopping at amazon.com with our affiliate

link: https://amazon.midrange.com

--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com