Function Compute:Configure JWT authentication for an HTTP trigger

1. Log on to the Function Compute console. In the left-side navigation pane, click Services & Functions.

2. In the top navigation bar, select a region. On the Services page, click the desired service.

3. On the Functions page, click the name of the desired function. On the Function Details page that appears, click the Trigger Management (URL) tab.

4. On the Trigger Management (URL) tab, click Modify in the Actions column of the HTTP trigger.

5. In the Modify Trigger panel, configure the following parameters and click OK.

   1. Set Authentication Method to JWT Authentication.

      

   2. Configure JWKS.

      To configure JWT authentication for an HTTP trigger, you must provide a valid JWKS. You can manually generate a JWKS, or search by JSON Web Key generator in a web browser to use an online generator, such as mkjwk.org. If you have a key in the Privacy Enhanced Mail (PEM) format, you can use a tool such as jwx to convert the key to the JWKS format.

      In this example, mkjwk.org is used to generate a JWKS. On the page for generating a JWKS, set Show X.509 to Yes to view private keys. You need to use the private key to issue a JWT. Keep the private key secure. You can copy the content of the public key to the keys array of JWKS in the Function Compute console. The following figure shows the details.

      

      Sample code:

      {
          "keys": [
              {
                  "alg": "RS256",
                  "e": "AQAB",
                  "kty": "RSA",
                  "n": "u1LWgoomekdOMfB1lEe96OHehd4XRNCbZRm96RqwOYTTc28Sc_U5wKV2umDzolfoI682ct2BNnRRahYgZPhbOCzHYM6i8sRXjz9Ghx3QHw9zrYACtArwQxrTFiejbfzDPGdPrMQg7T8wjtLtkSyDmCzeXpbIdwmxuLyt_ahLfHelr94kEksMDa42V4Fi5bMW4cCLjlEKzBEHGmFdT8UbLPCvpgsM84JK63e5ifdeI9NdadbC8ZMiR--dFCujT7AgRRyMzxgdn2l-nZJ2ZaYzbLUtAW5_U2kfRVkDNa8d1g__2V5zjU6nfLJ1S2MoXMgRgDPeHpEehZVu2kNaSFvDUQ",
                  "use": "sig"
              }
          ]
      }

   3. In the JWT Token Configuration section, select the position and name of the token.

      You can set the Read Position parameter of the token to Header, Cookie, Query Parameters, or Form Parameters. If you set the Read Position parameter of a token to Header, you must specify the Parameter Name and Remove Prefix parameters. When Function Compute obtains the token, the prefix that is specified by the Remove Prefix parameter is deleted.

      Important

      When you configure the Remove Prefix parameter, check whether spaces exist after the prefix. We recommend that you add a space after the specified prefix, for example, Bearer .

   4. In the JWT Claim Conversion section, select the position to pass parameters to the function, the original name of the parameter, and the new name of the parameter after the parameter is passed to the function.

      You can set the Mapping Parameter Position parameter to Header, Cookie, Query Parameters, or Form Parameters.

   5. Specify the request matching mode.

      • Match All: All HTTP requests must be verified by using JWT.

      • Whitelist Mode: HTTP requests that are sent from the paths specified in Whitelist of Request Paths are not authenticated by using JWTs. Other requests are authenticated by using JWTs.

      • Blacklist Mode: HTTP requests that are sent from the paths specified in Blacklist of Request Paths are authenticated by using JWTs. Other requests are not authenticated by using JWTs.

      Whitelist Mode and Blacklist Mode support the following matching modes:

      • Exact matching

        A path is matched only if it is exactly the same as the specified path. For example, if you set Blacklist of Request Paths to /a, JWT authentication is required for requests that are sent from /a. JWT authentication is not required for requests that are sent from /a/.

      • Fuzzy matching

        You can set the value to a path that is appended with an asterisk (*) as the wildcard. For example, if you set the Blacklist of Request Paths parameter to /login/*, JWT authentication is required for requests that are sent from the paths prefixed with /login/, such as /login/a and /login/b/c/d.

This section describes how to verify whether HTTP services can be accessed as expected by using a tool based on the JWT configurations of your HTTP trigger. In this section, Postman is used..

1. Use the private key in the X.509 PEM format generated in Step 1 as the private key to issue a JWT. The following steps use Python as an example to demonstrate the process of generating a token by using a local script.

   1. Install the PyJWT module.

      pip install PyJWT

   2. Run the following Python script on your on-premises machine to generate a JWT:

      import jwt
      import time
      
      private_key = """
      -----BEGIN PRIVATE KEY-----
      <Use the private key in the X.509 PEM format generated in Step 1>
      -----END PRIVATE KEY-----
      """
      
      headers = {
          "alg": "RS256",
          "typ": "JWT"
      }
      
      payload = {
          "sub": "1234567890",
          "name": "John Snow",
          "iat": int(time.time()),   # The time when the token was issued.
          "exp": int(time.time()) + 60 * 60,   # Set the validity period of the token to 1 hour.
      }
      
      
      encoded = jwt.encode(payload=payload, key=private_key.encode(), headers=headers)
      print("Generated token: %s" % encoded)
      

2. Use Postman to check whether the HTTP services can be accessed.

   1. On the Trigger Management (URL) tab of the function that you want to manage, obtain the Internet endpoint of the HTTP trigger. Then, enter the endpoint in the address bar of Postman.

   2. Configure the token parameters on the Headers tab in Postman and click Send to send the request. The following table describes the configuration of the token.

      Name	Example	Description
      Key	Authentication	The name of the token that you specified in the JWT Token Configuration section.
      Value	Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9uIFNub3ciLCJhZG1pbiI6dHJ1ZSwiZXhwIjo0ODI5NTk3NjQxfQ.eRcobbpjAd3OSMxcWbmbicOTLjO2vuLR9F2QZMK4rz1JqfSRHgwQVqNxcfOIO9ckDMNlF_3jtdfCfvXfka-phJZpHmnaQJxmnOA8zA3R4wF4GUQdz5zkt74cK9jLAXpokwrviz2ROehwxTCwa0naRd_N9eFhvTRnP3u7L0xn3ll4iOf8Q4jS0mVLpjyTa5WiBkN5xi9hkFxd__p98Pah_Yf0hVQ2ldGSyTtAMmdM1Bvzad-kdZ_wW0jcctIla9bLnOo-Enr14EsGvziMh_QTZ3HQtJuToSKZ11xkNgaz7an5de6PuF5ISXQzxigpFVIkG765aEDVtEnFkMO0xyPGLg	The JWT value, which contains the value of the Remove Prefix parameter in JWT Token Configuration. In this example, the Remove Prefix parameter is set to Bearer .

      Important

      The prefix and space of the JWT parameter in the request header must be the same as those of the Remove Prefix parameter in the JWT Token Configuration section. Otherwise, an error occurs when the trigger parses the token and reports the "invalid or expired jwt" error.