Hands-on Lab Session 9020 Working with JSON Web Token. Budi Darmawan, Bluemix Enablement

Size: px

Start display at page:

Download "Hands-on Lab Session 9020 Working with JSON Web Token. Budi Darmawan, Bluemix Enablement"

Nelson Berry
6 years ago
Views:

1 Hands-on Lab Session 9020 Working with JSON Web Token Budi Darmawan, Bluemix Enablement

2 Copyright IBM Corporation 2017 IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at This document is current as of the initial date of publication and may be changed by IBM at any time. The information contained in these materials is provided for informational purposes only, and is provided AS IS without warranty of any kind, express or implied. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, these materials. Nothing contained in these materials is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in these materials to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. This information is based on current IBM product plans and strategy, which are subject to change by IBM without notice. Product release dates and/or capabilities referenced in these materials may change at any time at IBM's sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way.

3 Contents Introduction 3 Exercise 1 5 Exercise 2 6 Exercise 3 11 Page 1 of 12

5 Introduction The instructions in this lab are written for the US South region in Bluemix. In these exercises, you explores the usage of JSON Web Token (JWT) to identify authorized connection between different components in a microservices based application. However since this application is a distributed microservices application, it takes quite a few components, hence you must have an adequate capacity within your Bluemix quota to perform this. You will need 512MB of application capacity and 1GB of Container capacity. JSON Web Token (JWT) is constructed into 3 pieces of identitification that can easily be sent as part of HTTP header. It contains the encryption algorithm, data (claim) and encrypted information. If the encrypted information cannot be matched to the claim, the request should be rejected. Page 3 of 12

As such JWT is a mechanism to ensure data-related authentication. So only parties that has the secret key are allowed to communicate.

6 In API Connect, JWT functionality is provided as part of the DataPower Gateway. It allows validation of incoming token and generation of outgoing token. Both functions are implemented in the gateway methods. As such JWT is a mechanism to ensure data-related authentication. So only parties that has the secret key are allowed to communicate. It contains claims that can be validated and checked againts the request. As such, JWT is typically used to validate that the client code (application) is authorized to make the request; also the make sure API caller is known. Page 4 of 12

This OpenLab contains the following steps: Exercise 1: Setting up your environment Exercise 2:

7 In BlueCompute application, JWT is used to validate calls to microservices are performed by API Connect. This OpenLab contains the following steps: Exercise 1: Setting up your environment Exercise 2: Checking JWT behavior Exercise 3: Cleaning up your resources (highly recommended) Exercise 1: Setting up your environment To prepare the environment, you must do the following: Page 5 of 12

1. Login to the virtual machine as bmxuser and password of passw0rd. Open a terminal Window by selecting Activities > from the panel and select XTerm. 2.

8 1. Login to the virtual machine as bmxuser and password of passw0rd. Open a terminal Window by selecting Activities > from the panel and select XTerm. 2. In the terminal window, load the repository for the lab setup scripts: git clone 3. Run the initialization script to setup your appropriate lab: cd interconnect2017./setuplab9020.sh Answer the prompts as required. This script performs the following tasks (Note: This script runs for around 10 minutes): Login to Bluemix Initialize container plugin Clone necessary GIT repositories Initialize Eureka and Zuul to act as JWT terminator Create and run inventory microservice within a container group Run the inventory BFF application To make sure that your BlueCompute instance is unique, we put in a suffix for each resources that you have. This suffix is derived from your IBMid, basically stripping out most punctuation from your IBMid. As an example the IBM id of vbudi@mail.com becomes a suffix of vbudimailcom. You should use this suffix for the following steps. Exercise 2: Checking JWT behavior This exercise tests the components of your BlueCompute application 1. Test existing inventory applications Check using curl direct invocation of the microservice, the operation below retrieves the information for item # This is a typically a protected resources, hence you should not be able to invoke the operation directly. Page 6 of 12

curl -X GET http://inventoryservice- <suffix>.mybluemix.net/micro/inventory/13401 The call is proxied using zuul. The client can get the link from Eureka using Ribbon.

9 curl -X GET <suffix>.mybluemix.net/micro/inventory/13401 The call is proxied using zuul. The client can get the link from Eureka using Ribbon. However, in this lab, you will be invoking zuul directly. Notice the inventoryservice qualifier in the path instead of the HOST part of the URL. curl -X GET Invoke the call through the BFF. The BFF serves a a development tool so that the FrontEnd can be built without waiting for the backend to be completed; also allows a simple data and format mapping of API call content. In this case, the BFF is just a pass through. curl -X GET 2. Login to Bluemix and create API Connect service Login to the Bluemix interface using your IBM id Create the API Connect service from the Catalog > APIs > API Connect. Click Create. In the dashboard click on the API Connect service. This action creates the default organization, which is in the format of <orgs>-<space>. In the API Connect management page, click the Menu icon and select Dashboard. Create a new catalog, select +Add > Catalog. For the catalog name, specify BlueCompute-<suffix>. Page 7 of 12

10 Collect client ID by clicking Show button. 3. Updating the inventory API. The inventory API must be defined with the proper BFF host address. To do this, edit refarch-cloudnative-api/inventory/inventory.yaml. Backup the inventory.yaml first: Edit the inventory.yaml for the value of x-ibmconfiguration.properties.target_host.value. This value must refer to the inventory BFF: cd refarch-cloudnative-api/inventory/ vi inventory.yaml Save the inventory.yaml file :wq and press Enter. Copy the inventory.yaml into a backup file cp inventory.yaml inventory.yaml.backup Edit again the inventory.yaml file to remove (for now) JWT definition. The lines with the highlight must be removed, there should be only invoke statement in the assembly. Page 8 of 12

$com -u <ibmid> -p <password> apic config:set catalog=apiccatalog://us.apiconnect.ibmcloud.com/orgs/<orgs>/catalogs/bluecompute-${suffix} apic publish inventory-product_0.0.1.yaml 5.$

11 4. Defining the inventory API Once you saved the inventory.yaml API definition, you can publish the API to API Connect. cd refarch-cloudnative-api/inventory apic login -s us.apiconnect.ibmcloud.com -u <ibmid> -p <password> apic config:set catalog=apiccatalog://us.apiconnect.ibmcloud.com/orgs/<orgs>/catalogs/bluecompute-${suffix} apic publish inventory-product_0.0.1.yaml 5. Test the API access from API Connect: curl -X GET -H 'X-IBM-Clientid: <clientid>' <suffix>/inventory/api/items/ Restart zuul and enable JWT authentication. The zuul proxy definition already contains a disabled JWT validation logic. Check the zuul configuration in refarch-cloudnative-netflixzuul/src/main/resources/application.yaml The parameters in the security block are: sharedsecret and enabled. On which the enabled has a default of false Stop and remove the zuul proxy: cf ic group rm zuul_cluster Once zuul cluster is deleted, start it again. Lets use your suffix as the sharedsecret in this test: Page 9 of 12

12 cf ic group create --name zuul_cluster --publish memory 256 \ --auto --min 1 --max 3 --desired 1 \ -n netflix-zuul-<suffix> -d mybluemix.net \ -e eureka.client.serviceurl.defaultzone=" <suffix>.mybluemix.net/eureka" \ -e security.enabled=true \ -e security.sharedsecret=<suffix> \ -e eureka.instance.hostname=netflix-zuul-<suffix>.mybluemix.net \ -e eureka.instance.nonsecureport=80 \ -e eureka.instance.preferipaddress=false \ -e spring.cloud.client.hostname=zuul-<suffix>.mybluemix.net \ registry.$region.bluemix.net/$ns/zuul-<suffix> 7. Verify API access using curl directly, through zuul, from the BFF and through API Connect. Notice that the only successful call (the call that returns original data) is a direct call to the microservice. Here are the list of curl commands: curl -X GET curl -X GET <suffix>.mybluemix.net/inventoryservice/micro/inventory/13401 curl -X GET curl -X GET -H 'X-IBM-Clientid: <clientid>' <suffix>/inventory/api/items/ Add JWT token in API Connect definition and Republish. Restore your inventory.yaml file cp inventory.yaml.backup inventory.yaml Edit inventory.yaml and change the sharedsecret to be your suffix. Save inventory.yaml file using :wq and press Enter. Republish your API definition apic config:set catalog=apic- catalog://us.apiconnect.ibmcloud.com/orgs/<orgs>/catalogs/bluecompute- ${SUFFIX} apic publish inventory-product_0.0.1.yaml 9. Test API access through API Connect. This should be successful now. Page 10 of 12 curl -X GET -H 'X-IBM-Clientid: <clientid>' <suffix>/inventory/api/items/13401

13 Exercise 3: Cleaning up your resources (highly recommended) This last exercise removes the services, applications and containers that have been defined in this course. This action is necessary so that your Bluemix trial account does not have extra resources that take up your quota. Optionally you may want to keep these resources to study that. 1. Remove Bluemix resources that you created in this lab: cd interconnect2017./removelab9020.sh 2. You can also manually remove the resources as follows: Delete the API Connect service cf delete-service "API Connect-xx" Remove the inventory BFF cf delete inventory-bff-app-<suffix> Remove inventory container group: cf ic group rm micro-inventory-group-<suffix> Remove zuul container group: cf ic group rm zuul_cluster Remove eureka container group: cf ic group rm eureka_cluster Remove mysql container: cf ic rm mysql-<suffix> Remove the images (eureka, zuul, mysql and inventory): Page 11 of 12

14 cf ic rmi registry.ng.bluemix.net/<namespace>/inventoryservice-<suffix> cf ic rmi registry.ng.bluemix.net/<namespace>/eureka-<suffix> cf ic rmi registry.ng.bluemix.net/<namespace>/zuul-<suffix> cf ic rmi registry.ng.bluemix.net/<namespace>/mysql-<suffix> Page 12 of 12

Hands-on Lab Session 9011 Working with Node.js Apps in IBM Bluemix. Pam Geiger, Bluemix Enablement

Hands-on Lab Session 9011 Working with Node.js Apps in IBM Bluemix Pam Geiger, Bluemix Enablement Copyright IBM Corporation 2017 IBM, the IBM logo and ibm.com are trademarks of International Business Machines