{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/644","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/644/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/644/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/644/events","html_url":"https://github.com/hashicorp/vault/issues/644","id":108292526,"number":644,"title":"Add Jose secret backend that replaces JWT backend","user":{"login":"dol","id":41777,"avatar_url":"https://avatars.githubusercontent.com/u/41777?v=3","gravatar_id":"","url":"https://api.github.com/users/dol","html_url":"https://github.com/dol","followers_url":"https://api.github.com/users/dol/followers","following_url":"https://api.github.com/users/dol/following{/other_user}","gists_url":"https://api.github.com/users/dol/gists{/gist_id}","starred_url":"https://api.github.com/users/dol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dol/subscriptions","organizations_url":"https://api.github.com/users/dol/orgs","repos_url":"https://api.github.com/users/dol/repos","events_url":"https://api.github.com/users/dol/events{/privacy}","received_events_url":"https://api.github.com/users/dol/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/hashicorp/vault/milestones/3","html_url":"https://github.com/hashicorp/vault/milestones/0.4.0","labels_url":"https://api.github.com/repos/hashicorp/vault/milestones/3/labels","id":1266940,"number":3,"title":"0.4.0","description":null,"creator":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":0,"state":"open","created_at":"2015-08-21T21:19:39Z","updated_at":"2015-09-25T11:35:59Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2015-09-25T09:33:16Z","updated_at":"2015-09-25T13:35:59Z","closed_at":null,"body":"The recently added JWT backend (#460) was removed due to a lot of work (@6c21b3b69343b17e716dc64b9312bfd2024bb33a) fixing up the backend.\r\n\r\nI agree on the removal of the backend. The backend has some flaws and is incomplete:\r\n* The possibility to verify the integrity of a token is missing. Sign and verify are the two building blocks of JWT\r\n* The 'claims' parameter in `/jwt/issue/<role>` is called 'payload' [1] in the JOSE world. See jwt.io or RFC 7519 [1]\r\n* Backend is limited to JWT only. In the JOSE [2] ecosystem JWS [3] and JWE [4] are the building blocks of JWT. A JWT/JWE endpoint is IMHO necessary.\r\n* Missing possibility to change the hashing algorithm assigned to a key. Once a key is added to the backend there is no option to change the hashing algorithm\r\n\r\nI don't wont to discourage @ekristen for his work. I think a ~~JWT~~JOSE backend is very usefull.\r\n\r\nIt would be very much appreciated if a revised version ot the JWT backend brought back to life.\r\n\r\n### Minor excursion on the JOSE ecosystem\r\n* JWE (E = encryption) is used to encrypt/decrypt JSON Objects\r\n* JWS (S = signing) is used to sign/verify JSON Objects\r\n* JWT (T = token)\r\n  * representation of claims\r\n  * protected by JWS or JWE\r\n    * types: plain, signed and encrypted\r\n\r\nI can recommend this blog post: https://securityblog.redhat.com/2015/04/01/jose-json-object-signing-and-encryption/\r\n\r\n### A proposal for a possible future API\r\n* Rename jwt to jose\r\n* Rename claims parameter in `/jwt/issue/<role>` to 'payload'\r\n* Add new endpoint to verify JWS/JWT\r\n  * `/jwt/verify/<role>`\r\n* Add new endpoint to decrypt a JWT/JWE\r\n  * `/jwt/decrypt/<role>`\r\n* Add possibility to change signature algorithm\r\n  * Rename 'algorithm' parameter in `/jwt/roles/` to 'default_sign_algorithm'\r\n  * Add new optional parameter 'sign_algorithm' to `/jwt/issue/<role>`\r\n* Add new optional parameter 'jwt=<boolean> (default: true)' to `/jwt/issue/<role>`, `/jwt/decrypt/<role>` and `/jwt/verify/<role>`\r\n  * `/jwt/issue/<role>` will add the default parameter used in JWT\r\n  * `/jwt/decrypt/<role>` and `/jwt/verify/<role>` will perform a claims validation\r\n* Add new endpoint that returns the public key as JWK\r\n  * `/jwt/role/<name>/publickey`\r\n* Add new optional parameter 'mode=<plain|sign|encrypt> (default: sign)' to `/jwt/issue/<role>`\r\n  * This is only possible with the parameter 'jwt=true'\r\n  * In some rare cases encrypting a JWT is used\r\n* Support 'Nested JWT' (rare usage)\r\n  * From the RFC 7519: A JWT in which nested signing and/or encryption are employed. In\r\n      Nested JWTs, a JWT is used as the payload or plaintext value of an\r\n      enclosing JWS or JWE structure, respectively.\r\n\r\nFor proper JOSE support I recommend using https://github.com/square/go-jose .\r\n\r\n[1] https://tools.ietf.org/html/rfc7519\r\n[2] https://tools.ietf.org/html/rfc7165\r\n[3] https://tools.ietf.org/html/rfc7515\r\n[4] https://tools.ietf.org/html/rfc7516\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/143225862","html_url":"https://github.com/hashicorp/vault/issues/644#issuecomment-143225862","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/644","id":143225862,"user":{"login":"ekristen","id":48329,"avatar_url":"https://avatars.githubusercontent.com/u/48329?v=3","gravatar_id":"","url":"https://api.github.com/users/ekristen","html_url":"https://github.com/ekristen","followers_url":"https://api.github.com/users/ekristen/followers","following_url":"https://api.github.com/users/ekristen/following{/other_user}","gists_url":"https://api.github.com/users/ekristen/gists{/gist_id}","starred_url":"https://api.github.com/users/ekristen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekristen/subscriptions","organizations_url":"https://api.github.com/users/ekristen/orgs","repos_url":"https://api.github.com/users/ekristen/repos","events_url":"https://api.github.com/users/ekristen/events{/privacy}","received_events_url":"https://api.github.com/users/ekristen/received_events","type":"User","site_admin":false},"created_at":"2015-09-25T13:35:58Z","updated_at":"2015-09-25T13:35:58Z","body":"@jefferai why not just open a ticket and ask me to fix, since I originally submitted this? I need JWT in Vault. \r\n\r\n> The big overarching problem with the JWT backend as-is (which I pushed up to a branch for keeping for the moment) is that it allows the caller to set any claim values they like, including issuer and issued_at. \r\n\r\nIt is not useless in its current state. You the admin of vault controls who and what has access to vault. I see the point you are making however and if that is a requirement then let me fix it. Lets not just yank it out. As for setting other claims, you do have to be able to support dynamic claims but we can blacklist some.\r\n\r\nTo the point that there is no verification method, that can be fixed too! That was an oversight on my part as I was thinking purely about the RS and EC algorithms and how there is a public key to be able to be used **outside** of vault to verify and in my use cases I was going to be verifying outside of Vault. I wanted vault for the secure storage of the private key and to prevent needing to give it to my developers. Where as with the HS signing algorithms its a shared key, so I see the need for verification.\r\n\r\nI disagree on being able to change a signing algorithm for a role. The signing algorithm is set at role creation time because the key has to be verified as usable by the algorithm.\r\n\r\n@jefferai what do you need for this to be added back in for 0.3?"}}