Hi - a project that I am currently working on requires the use of the Blue Prism supported JWT VBO. I need to generate a JWT token using the RSA256 method.
After importing the VBO into my environment, I have 26 errors (please see screenshot). I suspect that this is because of the pre-requisite assemblies (DLLs) that are required from Nuget.
Is my assumption correct? Are the 3 assemblies listed below the correct ones? And if so, how do I install these onto the Blue Prism virtual machines?
Finally, looking at the code stage for generating a token using RSA256, I see no reference to headers, just the input 'payload' (collection of claims). Is this sufficient? I understand the target system requiring a JWT token requires certain values in the headers.
@charliekovacs thanks for your response. That has removed our compiler errors.
I am able to generate a private key, public key etc and read these into Blue Prism.
However, when running the 'Generate RS256 Token' action, I get the following error message:
Thank you for your response - I followed those steps (installed an older version of JWT) and that has got my JWT token creation working.
I have a follow-on issue/question however:
When I generate a private/public key pair within the VBO itself, I am able to run the Generate JWT (RS256) action with no issues.
However, the target system requires that I generate an X509 certificate with corresponding public key. This looks simple using OpenSSL, but is there any way this can be supported within Blue Prism?
I can see a 'Create X509 Certificate' action in the Blue Prism JWT VBO, but I cannot configure it to work successfully. Do you know how to resolve this error?
To prove the concept, I separately tried generating the private key manually using openssl then inputting into Blue Prism. The private key looks like this in structure (obviously with several rows removed for security purposes)
Hi @JackLeyland
I believe the Generate JWT (RS256) action is looking for a slightly different private key file format - specifically RSA. Here is an example:
-----BEGIN RSA PRIVATE KEY-----MIIEpAIBAAKCAQEArh8F9RUrlscndS8S...-----END RSA PRIVATE KEY-----
The only different is it states RSA Private Key instead of just Private Key. The Generate RSA Keypair action can create this and OpenSSL can do it, too, as you mentioned. I was able to do it with OpenSSL using the following set of commands:
- Generate RSA private key:
openssl genrsa -out private-key.pem 2048 - Generate corresponding public key:
openssl rsa -in private-key.pem -pubout -out public-key.pem - Optional: create X509 certificate based on RSA private key:
openssl eq -new -x509 -key private-key.pem -out cert.pem -days 360 -subj "/C=US/ST=Texas/L=Austin/O=example/CN=example"
To do this in Blue Prism, I recommend the Utility - Environment object as I do not think the X509 action in the JWT object works in its current state. Use the Run Process Until Ended action which has four inputs:
- Application: the path to
openssl.exeon your computer. - Arguments: everything that follows the command. Example:
genrsa -out private-key.pem 2048 - Working Folder: the folder where the .pem files should be created. Example:
C:\Users\me\Desktop\(I think the trailing backslash is required) - Timeout: this defaults to ten seconds which should be plenty, so it can be left blank
So, my advice is to make sure your OpenSSL commands work first and that it generates a good RSA private key file that the Generate JWT (RS256) action accepts. And then use the Utility - Environment object to automate those OpenSSL commands in your process.
@charliekovacs thanks again, I appreciate your help on this.
I have been able to progress further and now have a working 'pipeline' of steps
- Generate RSA private/public key using BP VBO
- Generate X509 certificate using OpenSSL (using the private key generated in step 1)
- Generate RS256 JWT token using BP VBO
I have one final challenge. The target system dictates that I need specific values in the 'headers' for my token. As previously mentioned these are auto-generated and not editable using the existing input parameters in the VBO.
Currently the headers are auto-generated as follows, but I need one more attribute 'kid'.
Do you know how I would be able to amend this? I assume it will require some manipulation of the (global) code?
Many thanks
Jack
Hi @JackLeyland
Yes, that should be doable with a slight adjustment to the code stage on the Generate JWT (RSA256) action.
1) Create a new data item to store the KID value (data type: Text). Add it as an input value on the Start parameters
2) Open the Generate JWT code stage. On the Inputs tab, create an entry for this KID Value data item and give it a name of KidValue
3) Switch to the Code tab and update as follows:
a) Remove Line 34: Token = encoder.Encode(payload, privateKey);
b) Paste this block of code in, starting on Line 34:
if (string.IsNullOrEmpty(KidValue)){ Token = encoder.Encode(payload, privateKey);}else{ var kidHeader = new Dictionary<string, object>{{"kid", KidValue}}; Token = encoder.Encode(kidHeader, payload, privateKey);}
It should look like this:
Click the Check Code button to make sure no errors are found with this update, save the VBO, and then it should work. When you run this action from a process, pass in a value to the KID Value input and it will include it in the JWT header. If you leave KID Value blank, it will leave it out of the header, so this makes it flexible.
If you need to use any of the other JWT actions besides Generate JWT (RSA256), I think you would need to repeat these steps in those other action pages as well.
I did not fully test the JWT token this produces against a system or anything, but I inspected it and it looks to be formatted correctly: {"kid":"example-kid-value","typ":"JWT","alg":"RS256"}
Let me know if this works. I will look into possibly making this an official update to the JWT object.
