使用JWT和发送消息(XMPP)的MongooseIM身份验证

Question

mongooseim规定使用JWT而不是用户名和密码进行授权。

在服务器端，文档建议修改mongooseim.toml文件（可在/etc/mongooseim/mongooseim.toml)

[auth]
  methods = ["jwt"]

  [auth.jwt]
    secret.value = "top-secret123"
    algorithm = "HS256"
    username_key = "user"

但如何从Gajim或Java代码进行身份验证呢？

Answer 1

我们先来了解一下幕后发生了什么。

而不是传递用户名-密码对。我们创建一个JWT令牌并发送它。JWT令牌是无状态的，这意味着如果您拥有密钥，您可以将令牌解码并编码到原始消息。

这里有一个Java的工作代码。我们生成JWT令牌并发送该令牌而不是密码。为了生成JWT令牌，我们使用了Auth0（您将需要在classpath中添加它）。链接到maven项目。

import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import org.apache.axis2.java.security.TrustAllTrustManager;
import org.jivesoftware.smack.AbstractXMPPConnection;
import org.jivesoftware.smack.ConnectionConfiguration;
import org.jivesoftware.smack.chat2.Chat;
import org.jivesoftware.smack.chat2.ChatManager;
import org.jivesoftware.smack.tcp.XMPPTCPConnection;
import org.jivesoftware.smack.tcp.XMPPTCPConnectionConfiguration;
import org.jxmpp.jid.Jid;
import org.jxmpp.jid.impl.JidCreate;

import java.net.InetAddress;
import java.util.Date;

public class JWTMain {
    private final static String senderUsername = "jatin";
    private final static String senderPassword = "abcd";

    private final static String sendTo = "dad";

    public static void main(String[] args) {
        try {
            Algorithm algorithm = Algorithm.HMAC256("top-secret123");
            String token = JWT.create()
                    .withClaim("user",senderUsername) // they key needs to match with `username_key` in mongooseim.toml file
                    .withClaim(senderUsername, senderPassword)
                    .sign(algorithm);

            System.out.println("Token generated: " + token);

            XMPPTCPConnectionConfiguration config = XMPPTCPConnectionConfiguration.builder()
                    .setSecurityMode(ConnectionConfiguration.SecurityMode.required)
                    .setUsernameAndPassword(senderUsername, token)
                    .setXmppDomain(JidCreate.domainBareFrom("localhost"))
                    .setHostAddress(InetAddress.getByName("localhost"))
                    .setPort(5222)
                    .setCustomX509TrustManager(new TrustAllTrustManager())
                    .addEnabledSaslMechanism("PLAIN")
                    .build();

            AbstractXMPPConnection connection = new XMPPTCPConnection(config);
            AbstractXMPPConnection connect = connection.connect();
            connection.login();
            sendMessage("This message is being sent programmatically? " + new Date(), sendTo + "@localhost", connect);
        } catch (Exception ex) {
            ex.printStackTrace();
        }
    }

    private static void sendMessage(String body, String toJid, AbstractXMPPConnection mConnection) throws Exception {
        Jid jid = JidCreate.from(toJid);
        Chat chat = ChatManager.getInstanceFor(mConnection)
                .chatWith(jid.asEntityBareJidIfPossible());
        chat.send(body);
        System.out.println("Message sent to : " + toJid);
    }
}

如果希望使用JWT令牌登录到Gajim：

上面的程序输出JWT令牌。您可以使用该令牌并在密码字段中提供该令牌。