1

I want to implement out callout authentication on NATS. I have created a console application that listens to the $SYS.REQ.USER.AUTH topic. Based on the received username and password, I generate a JWT token and allow the user to access their authorized topics. However, after generating the token, I encounter the following error:

Has anyone faced a similar issue? Thanks in advance.

7] 2025/03/12 18:47:28.318794 [ERR] 127.0.0.1:34882 - cid:32 - authentication error - User "alice" 2025-03-12 21:47:28 [7] 2025/03/12 18:47:28.318831 [TRC] 127.0.0.1:34882 - cid:32 - ->> [-ERR Authorization Violation] 2025-03-12 21:47:28 [7] 2025/03/12 18:47:28.318869 [DBG] 127.0.0.1:34882 - cid:32 - Client connection closed: Authentication Failure 2025-03-12 21:47:28 [7] 2025/03/12 18:47:28.318941 [WRN] Not an authorization request claim 2025-03-12 21:47:28 [7] 2025/03/12 18:47:28.318973 [TRC] ACCOUNT - <-> [DELSUB 28] 2025-03-12 21:47:28 [7] 2025/03/12 18:47:28.318990 [ERR] 127.0.0.1:34882 - cid:32 - authentication error - User "alice" 2025-03-12 21:47:28 [7] 2025/03/12 18:47:28.319038 [TRC] ACCOUNT - <<- [PUB $SYS.ACCOUNT.CLIENT.AUTH.ERR 763] 2025-03-12 21:47:28 [7] 2025/03/12 18:47:28.319047 [TRC] ACCOUNT - <<- MSG_PAYLOAD: ["{"type":"io.nats.server.advisory.v1.client_disconnect","id":"KOwQzxP6idqSC7QHOVpLD5","timestamp":"2025-03-12T18:47:28.318985439Z","server":{"name":"NAIKY3SN333SJMWKMJVCTK77YY5MFOHOVWZLIKMGXCQ4EHGUDJE3TMLQ","host":"0.0.0.0","id":"NAIKY3SN333SJMWKMJVCTK77YY5MFOHOVWZLIKMGXCQ4EHGUDJE3TMLQ","domain":"mainnode","ver":"2.10.26","jetstream":true,"flags":3,"seq":280,"time":"2025-03-12T18:47:28.319024442Z"},"client":{"start":"2025-03-12T18:47:28.313633709Z","host":"127.0.0.1","id":32,"acc":"AUTH","user":"alice","name":"NATS CLI Version 0.1.6","lang":"go","ver":"1.38.0","rtt":621000,"stop":"2025-03-12T18:47:28.318985439Z","kind":"Client","client_type":"nats"},"sent":{"msgs":0,"bytes":0},"received":{"msgs":0,"bytes":0},"reason":"Not an authorization request claim"}"]

 private static string CreateUserJwt(User user, AuthorizationRequest request){

 var issuerKey = "SAAH3RHRIFXZGSPDONXD3X2LK4LUSQSEPFXFIROLEH6C2UJBHHTVGX5KLI";
 var IssuerPublicKey = "ABC53VGEEBXCIWW4AJKLL2JMVPUUXXF74LCM3Q6AHLPWKH5JLDO7VCGQ";

 var keyPair = Nkeys.FromSeed(issuerKey);

 var jwtHeader = new
 {
     typ = "JWT",
     alg = "ed25519-nkey"
 };

 var natsData = new
 {
     type = "user",
     version = 2,
     pub = new
     {
         allow = new[] { "test.>" } 
     },
     sub = new
     {
         allow = new[] { "test.>" } 
     },
     data = -1,
     payload = -1
 };

 var jwtPayload = new
 {
     aud = request.Nats.ServerId.Id,
     jti = Guid.NewGuid().ToString().Replace("-", "").ToUpper(),
     iat = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
     iss = IssuerPublicKey,
     name = user.Username,
     sub = request.Nats.UserNKey,
     nats = natsData
 };

 string encodedHeader = Base64UrlEncode(JsonConvert.SerializeObject(jwtHeader));
 string encodedPayload = Base64UrlEncode(JsonConvert.SerializeObject(jwtPayload));

 // JWT Signing Input
 string signingInput = $"{encodedHeader}.{encodedPayload}";
 byte[] signingBytes = Encoding.UTF8.GetBytes(signingInput);

 byte[] signature = keyPair.Sign(signingBytes);
 string encodedSignature = Base64UrlEncode(signature);

 string jwtToken = $"{encodedHeader}.{encodedPayload}.{encodedSignature}";

 return jwtToken;}

nats-server.conf

**# Account configuration**
 accounts {
    AUTH: {
    users: [{ user: auth, password: auth }]
},
SYS: {},
ACC: {}
}

**# Authorization & Auth Callout Configuration**
authorization {
auth_callout {
    account: AUTH
    users: ["auth"]
    issuer: 
"ABC53VGEEBXCIWW4AJKLL2JMVPUUXXF74LCM3Q6AHLPWKH5JLDO7VCGQ"
}
}

**# Set system account**

system_account: SYS

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.