1"use strict";(self.webpackChunkpartners=self.webpackChunkpartners||[]).push([[15253],{15680:(e,n,t)=>{t.d(n,{xA:()=>s,yg:()=>c});var r=t(96540);function a(e,n,t){return n in e?Object.defineProperty(e,n,{value:t,enumerable:!0,configurable:!0,writable:!0}):e[n]=t,e}function i(e,n){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);n&&(r=r.filter((function(n){return Object.getOwnPropertyDescriptor(e,n).enumerable}))),t.push.apply(t,r)}return t}function o(e){for(var n=1;n<arguments.length;n++){var t=null!=arguments[n]?arguments[n]:{};n%2?i(Object(t),!0).forEach((function(n){a(e,n,t[n])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(t)):i(Object(t)).forEach((function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(t,n))}))}return e}function l(e,n){if(null==e)return{};var t,r,a=function(e,n){if(null==e)return{};var t,r,a={},i=Object.keys(e);for(r=0;r<i.length;r++)t=i[r],n.indexOf(t)>=0||(a[t]=e[t]);return a}(e,n);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)t=i[r],n.indexOf(t)>=0||Object.prototype.propertyIsEnumerable.call(e,t)&&(a[t]=e[t])}return a}var _=r.createContext({}),p=function(e){var n=r.useContext(_),t=n;return e&&(t="function"==typeof e?e(n):o(o({},n),e)),t},s=function(e){var n=p(e.components);return r.createElement(_.Provider,{value:n},e.children)},u="mdxType",m={inlineCode:"code",wrapper:function(e){var n=e.children;return r.createElement(r.Fragment,{},n)}},d=r.forwardRef((function(e,n){var t=e.components,a=e.mdxType,i=e.originalType,_=e.parentName,s=l(e,["components","mdxType","originalType","parentName"]),u=p(t),d=a,c=u["".concat(_,".").concat(d)]||u[d]||m[d]||i;return t?r.createElement(c,o(o({ref:n},s),{},{components:t})):r.createElement(c,o({ref:n},s))}));function c(e,n){var t=arguments,a=n&&n.mdxType;if("string"==typeof e||a){var i=t.length,o=new Array(i);o[0]=d;var l={};for(var _ in n)hasOwnProperty.call(n,_)&&(l[_]=n[_]);l.originalType=e,l[u]="string"==typeof e?e:a,o[1]=l;for(var p=2;p<i;p++)o[p]=t[p];return r.createElement.apply(null,o)}return r.createElement.apply(null,t)}d.displayName="MDXCreateElement"},84992:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>_,contentTitle:()=>o,default:()=>m,frontMatter:()=>i,metadata:()=>l,toc:()=>p});var r=t(58168),a=(t(96540),t(15680));const i={},o="Environment Variables - JWT",l={unversionedId:"docs/on-premises/environment-variables/jwt",id:"docs/on-premises/environment-variables/jwt",title:"Environment Variables - JWT",description:"JWT bearer authentication",source:"@site/docs/docs/on-premises/environment-variables/jwt.md",sourceDirName:"docs/on-premises/environment-variables",slug:"/docs/on-premises/environment-variables/jwt",permalink:"/docs/on-premises/environment-variables/jwt",draft:!1,editUrl:"https://github.com/pactflow/docs.pactflow.io/edit/master/website/docs/docs/on-premises/environment-variables/jwt.md",tags:[],version:"current",lastUpdatedBy:"Yousaf Nabi",lastUpdatedAt:1674493712,formattedLastUpdatedAt:"Jan 23, 2023",frontMatter:{}},_={},p=[{value:"JWT bearer authentication",id:"jwt-bearer-authentication",level:2},{value:"PACTFLOW_JWT_BEARER_TOKEN_AUTH_ENABLED",id:"pactflow_jwt_bearer_token_auth_enabled",level:3},{value:"PACTFLOW_JWT_BEARER_TOKEN__JWKS_URL",id:"pactflow_jwt_bearer_token__jwks_url",level:3},{value:"PACTFLOW_JWT_BEARER_TOKEN__AUDIENCE",id:"pactflow_jwt_bearer_token__audience",level:3},{value:"PACTFLOW_JWT_BEARER_TOKEN__ISSUER",id:"pactflow_jwt_bearer_token__issuer",level:3},{value:"PACTFLOW_JWT_BEARER_TOKEN__EXPIRY_LEEWAY",id:"pactflow_jwt_bearer_token__expiry_leeway",level:3},{value:"PACTFLOW_JWT_BEARER_TOKEN__AUTH_CONFIG_HANDLER",id:"pactflow_jwt_bearer_token__auth_config_handler",level:3},{value:"PACTFLOW_JWT__CLAIM_MAPPINGS__{KEY}",id:"pactflow_jwt__claim_mappings__key",level:3}],s={toc:p},u="wrapper";
1function m(e){let{components:n,...t}=e;return(0,a.yg)(u,(0,r.A)({},s,t,{components:n,mdxType:"MDXLayout"}),(0,a.yg)("h1",{id:"environment-variables---jwt"},"Environment Variables - JWT"),(0,a.yg)("head",null,(0,a.yg)("meta",{name:"robots",content:"noindex"})),(0,a.yg)("h2",{id:"jwt-bearer-authentication"},"JWT bearer authentication"),(0,a.yg)("hr",null),"These settings can be configured in a YAML file, as per this example.",(0,a.yg)("pre",null,(0,a.yg)("code",{parentName:"pre",className:"language-yaml"},"jwt_bearer_token_auth_enabled: true\njwt_bearer_token:\n issuer: https://idp\n audience: some-aud\n expiry_leeway: 60\n jwks_url: https://idp/jwks\n auth_config_handler: auth_ext_script.rb\n claim_mappings:\n idp_id: SomeUniqueIdentifier\n email: EmailAddress\n name: DisplayName\n first_name: FirstName\n last_name: LastName\n")),(0,a.yg)("h3",{id:"pactflow_jwt_bearer_token_auth_enabled"},"PACTFLOW_JWT_BEARER_TOKEN_AUTH_ENABLED"),(0,a.yg)("p",null,"Whether or not to enable JWT bearer token authentication."),(0,a.yg)("p",null,(0,a.yg)("strong",{parentName:"p"},"Supported versions:")," From v1.16.0",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Required:")," false",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Default:")," ",(0,a.yg)("inlineCode",{parentName:"p"},"false"),(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Allowed values:")," ",(0,a.yg)("inlineCode",{parentName:"p"},"true"),", ",(0,a.yg)("inlineCode",{parentName:"p"},"false"),(0,a.yg)("br",null)),(0,a.yg)("h3",{id:"pactflow_jwt_bearer_token__jwks_url"},"PACTFLOW_JWT_BEARER_TOKEN","_","_","JWKS_URL"),(0,a.yg)("p",null,"The endpoint from which the JSON web key set can be retrieved to decode and verify the JWT used as the bearer token."),(0,a.yg)("p",null,(0,a.yg)("strong",{parentName:"p"},"Supported versions:")," From v1.16.0",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Required:")," true",(0,a.yg)("br",null)),(0,a.yg)("h3",{id:"pactflow_jwt_bearer_token__audience"},"PACTFLOW_JWT_BEARER_TOKEN","_","_","AUDIENCE"),(0,a.yg)("p",null,'The expected token audience ("aud") of the JWT.'),(0,a.yg)("p",null,(0,a.yg)("strong",{parentName:"p"},"Supported versions:")," From v1.16.0",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Required:")," true",(0,a.yg)("br",null)),(0,a.yg)("h3",{id:"pactflow_jwt_bearer_token__issuer"},"PACTFLOW_JWT_BEARER_TOKEN","_","_","ISSUER"),(0,a.yg)("p",null,'The expected token issuer ("iss") of the JWT.'),(0,a.yg)("p",null,(0,a.yg)("strong",{parentName:"p"},"Supported versions:")," From v1.16.0",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Required:")," true",(0,a.yg)("br",null)),(0,a.yg)("h3",{id:"pactflow_jwt_bearer_token__expiry_leeway"},"PACTFLOW_JWT_BEARER_TOKEN","_","_","EXPIRY_LEEWAY"),(0,a.yg)("p",null,"The number of seconds of leeway to allow when verifying the expiration of the JWT, to allow for click drift between Pactlow and the Identity Provider."),(0,a.yg)("p",null,(0,a.yg)("strong",{parentName:"p"},"Supported versions:")," From v1.16.0",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Required:")," false",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Default:")," ",(0,a.yg)("inlineCode",{parentName:"p"},"0"),(0,a.yg)("br",null)),(0,a.yg)("h3",{id:"pactflow_jwt_bearer_token__auth_config_handler"},"PACTFLOW_JWT_BEARER_TOKEN","_","_","AUTH_CONFIG_HANDLER"),(0,a.yg)("p",null,"The name of a Ruby script which will parse the decoded JWT and extract the roles and teams associated with the user. The script must be mounted into the PactFlow Docker container in the directory ",(0,a.yg)("inlineCode",{parentName:"p"},"/home/pactflow/extensions"),"."),(0,a.yg)("p",null,(0,a.yg)("strong",{parentName:"p"},"Supported versions:")," From v1.16.0",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Required:")," false",(0,a.yg)("br",null)),(0,a.yg)("h3",{id:"pactflow_jwt__claim_mappings__key"},"PACTFLOW_JWT","_","_","CLAIM_MAPPINGS","_","_","{KEY}"),(0,a.yg)("p",null,"This setting maps the IDP's claims in the JWT to the required PactFlow user attributes. This setting is best configured in the YAML file as a map.\nAt least one of the keys must be called ",(0,a.yg)("inlineCode",{parentName:"p"},"sub")," or ",(0,a.yg)("inlineCode",{parentName:"p"},"idp_id"),". This will be used by PactFlow to uniquely identify the user from the Identify Provider.\nThe other recommended keys are ",(0,a.yg)("inlineCode",{parentName:"p"},"name"),", ",(0,a.yg)("inlineCode",{parentName:"p"},"email"),", ",(0,a.yg)("inlineCode",{parentName:"p"},"first_name")," and ",(0,a.yg)("inlineCode",{parentName:"p"},"last_name"),"."),(0,a.yg)("p",null,"eg."),(0,a.yg)("pre",null,(0,a.yg)("code",{parentName:"pre",className:"language-yaml"},'jwt_bearer_token_auth_enabled: true\njwt_bearer_token:\n # other configurations here ...\n claim_mappings:\n idp_id: "SomeUniqueIdentifier"\n name: "Name"\n email: "Email"\n first_name: "FirstName"\n last_name: "LastName"\n')),(0,a.yg)("p",null,"When setting the claim mappings using environment variables, a separate environment variable must be used for each claim mapping.\nThe key name must be uppercased and prefixed by ",(0,a.yg)("inlineCode",{parentName:"p"},"PACTFLOW_JWT__CLAIM_MAPPINGS__"),"."),(0,a.yg)("p",null,"eg."),(0,a.yg)("pre",null,(0,a.yg)("code",{parentName:"pre",className:"language-shell"},'PACTFLOW_JWT__CLAIM_MAPPINGS__IDP_ID="SomeUniqueIdentifier"\nPACTFLOW_JWT__CLAIM_MAPPINGS__NAME="Name"\nPACTFLOW_JWT__CLAIM_MAPPINGS__EMAIL="Email"\nPACTFLOW_JWT__CLAIM_MAPPINGS__FIRST_NAME="FirstName"\nPACTFLOW_JWT__CLAIM_MAPPINGS__LAST_NAME="LastName"\n')),(0,a.yg)("p",null,(0,a.yg)("strong",{parentName:"p"},"Supported versions:")," From v1.16.0",(0,a.yg)("br",null),"\n",(0,a.yg)("strong",{parentName:"p"},"Required:")," false",(0,a.yg)("br",null)))}m.isMDXComponent=!0}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.