Failing to generate JWT using a password protected private key.

anonymous · June 11, 2019, 11:22am

I am not able to generate JWT using a password protected private key. I am getting following response:

{
    "fault": {
        "faultstring": "Failed to parse key: policy(Generate-JWT-Token) ",
        "detail": {
            "errorcode": "steps.jwt.KeyParsingFailed"
        }
    }
}

I am not sure if the policy is able to consume the password protected private key in this case. I might be missing something here. Please help.

Here is my setup

I have generated PEM (password protected private key) using following command

openssl pkcs12 -in tokensigning.pfx -nocerts -out token-private-key.pem

Here is the encryption method details from PFX

openssl pkcs12 -info -in tokensigning.pfx -nooutPKCS7 Data

Output:
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2000
PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2000

Private Key

Bag Attributes
    Microsoft Local Key set: <No Values>
    localKeyID: 01 00 00 00 
    Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
    friendlyName: some-friendly-name-16a8f7db122f
Key Attributes
    X509v3 Key Usage: 10 
-----BEGIN ENCRYPTED PRIVATE KEY-----
key data.......
-----END ENCRYPTED PRIVATE KEY-----

KeyValueMap Policy

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<KeyValueMapOperations name="KVM-GetTokenSigningPrivateKey" mapIdentifier="oauth-token-signing">
    <Scope>environment</Scope>
    <ExpiryTimeInSecs>15</ExpiryTimeInSecs>
    <Get assignTo="private.private-key">
        <Key>
            <Parameter>privatekey</Parameter>
        </Key>
    </Get>
    <Get assignTo="private.privatekey-password">
        <Key>
            <Parameter>privatekey-password</Parameter>
        </Key>
    </Get>
</KeyValueMapOperations>

Generate JWT policy

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<GenerateJWT name="Generate-JWT-Token">
    <Algorithm>RS256</Algorithm>
    <PrivateKey>
        <Value ref="private.private-key"/>
        <Password ref="private.privatekey-password"/>
        <Id>unique-identifier-for-privatekey-here</Id>
    </PrivateKey>
    <Subject>ABCD</Subject>
    <Issuer>urn://1a4b40567d5a</Issuer>
    <Audience>urn://api.dev</Audience>
    <ExpiresIn>60m</ExpiresIn>
    <AdditionalClaims>
        <Claim name="apigee-proxy" ref="apiproxy.name"/>
        <Claim name="messageid" ref="messageid"/>
        <Claim name="request-path" ref="request.path"/>
        <Claim name="apigee-org" ref="organization.name"/>
        <Claim name="apigee-env" ref="environment.name"/>
    </AdditionalClaims>
    <OutputVariable>output-jwt</OutputVariable>
</GenerateJWT>

anonymous · June 11, 2019, 1:09pm

Hi @Dino-at-Google, Any inputs on what I might be doing wrong here?

anonymous · June 11, 2019, 3:23pm

I guess the issue is with your private key. Maybe it is not supported in APigee

I have never used a private key which has BagAttributes.

Even I am waiting for Dino’s answer in this.

dchiesa1 · June 11, 2019, 10:52pm

The GenerateJWT policy in Apigee Edge is pretty limited in the kind of encryption you can use on your private key. In short, you need to use DES-EDE3-CBC, today, and you need to use the old serialization format, which looks like this:

As I type this, there is a release being rolled out to the Edge cloud that supports a wide variety of encryption algorithms. It also supports both the older serialization format, shown above, and the newer serialization format, which looks like this:

There are other changes coming to the JWT policies, and I’ve written about them in some detail, here.

This updated release is being rolled to Asia Pacific and EU now, north and south america soon. Check the status page for details and updates.

When this release becomes available for you, you must specify the key PEM in a form like the above. It should not have extraneous material like so:

Bag Attributes
    Microsoft Local Key set: <No Values>
    localKeyID: 01 00 00 00 
    Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider
    friendlyName: some-friendly-name-16a8f7db122f
Key Attributes
    X509v3 Key Usage: 10 
-----BEGIN ENCRYPTED PRIVATE KEY-----
key data.......
-----END ENCRYPTED PRIVATE KEY-----

Just start with the header and end with the footer.

-----BEGIN ENCRYPTED PRIVATE KEY-----
key data.......
-----END ENCRYPTED PRIVATE KEY-----

anonymous · June 12, 2019, 10:01am

Hey @Dino-at-Google, Good to know that new release is going to support additional algorithms and will have added security in place. I am eagerly waiting it to complete. Many thanks for taking time out for looking into my question.

dchiesa1 · June 12, 2019, 3:58pm

I’m glad to be of service, Amit!

anonymous · June 17, 2019, 1:32pm

Hey @Dino-at-Google, Do you know by when this roll out to be completed in EU. I am seeing an erratic behavior. My endpoint which is reading a Encrypted Private Key works once in five tries. Is is something related to the roll-out?

	-----BEGIN ENCRYPTED PRIVATE KEY-----
	key data.......
	-----END ENCRYPTED PRIVATE KEY-----

Please let me know if you would like me to raise this as a separate question.

anonymous · December 4, 2020, 9:08am

Hello @Dino-at-Google, colleagues,

today I try with all the instructions/best practices shared in this and similar posts, but it all fails.

I generate an encrypted DES-EDE3-CBC RS256 private key using password “1234” with this command:

openssl genrsa -des3 -out private-encrypted-rsa-des3.pem 2048

C:\Users\Rostislav_Dublin\IdeaProjects\osdu-epam\entitlements>openssl genrsa -des3 -out private-encrypted-rsa-des3.pem 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
........................+++++
............................+++++
e is 65537 (0x010001)
Enter pass phrase for private-encrypted-rsa-des3.pem:
Verifying - Enter pass phrase for private-encrypted-rsa-des3.pem:<br>

The resulting file is

I use Edge UI to paste it to the KVM:
I have these policies:

3.1. Get Secrets

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<KeyValueMapOperations mapIdentifier="KVM" async="false" continueOnError="false" enabled="true" name="GetKVM">
    <DisplayName>Get Secrets</DisplayName>
    <ExpiryTimeInSecs>3</ExpiryTimeInSecs>
    <Scope>environment</Scope>
    <Get assignTo="private.privatekey">
        <Key>
            <Parameter>RS256PK</Parameter>
        </Key>
    </Get>
    <Get assignTo="private.privatekey_password">
        <Key>
            <Parameter>RS256PKPassword</Parameter>
        </Key>
    </Get>
    <Get assignTo="private.secret_key">
        <Key>
            <Parameter>SecretKey</Parameter>
        </Key>
    </Get>
</KeyValueMapOperations>

3.2. Generate JWT

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<GenerateJWT async="false" continueOnError="false" enabled="true" name="Generate-JWT">
    <Algorithm>RS256</Algorithm>
    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
    <PrivateKey>
        <Value ref="private.privatekey"/>
        <ID>123456789</ID>
        <Password ref="private.privatekey_password"/>
    </PrivateKey>
    <Subject ref="google_tokeninfo.user_id"/>
    <Issuer>apigee</Issuer>
    <Audience ref="google_tokeninfo.audience"/>
    <ExpiresIn>1800s</ExpiresIn>
    <Id/>
    <AdditionalClaims>
        <Claim name="email" ref="google_tokeninfo.email"/>
        <Claim name="azp" ref="google_tokeninfo.issued_to"/>
    </AdditionalClaims>
    <OutputVariable>apigee_jwt_token</OutputVariable>
</GenerateJWT>

3.3. Those policies are invoked from the Target Response PreFlow

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<GenerateJWT async="false" continueOnError="false" enabled="true" name="Generate-JWT">
    <Algorithm>RS256</Algorithm>
    <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
    <PrivateKey>
        <Value ref="private.privatekey"/>
        <ID>123456789</ID>
        <Password ref="private.privatekey_password"/>
    </PrivateKey>
    <Subject ref="google_tokeninfo.user_id"/>
    <Issuer>apigee</Issuer>
    <Audience ref="google_tokeninfo.audience"/>
    <ExpiresIn>1800s</ExpiresIn>
    <Id/>
    <AdditionalClaims>
        <Claim name="email" ref="google_tokeninfo.email"/>
        <Claim name="azp" ref="google_tokeninfo.issued_to"/>
    </AdditionalClaims>
    <OutputVariable>apigee_jwt_token</OutputVariable>
</GenerateJWT>

With all this I take necessary data from incoming Google tokens and generate my own JWT tokens.
It works:

The question is:

Why does it fail in at least 75% cases?

Does it work as expected?
Only one of four requests succeeds:

dchiesa1 · December 4, 2020, 7:24pm

This is a new question. I suggest that you ask a new question, rather than posting your question as an answer to an 18-month old, already resolved question. The old question is similar, but not the same.

I have some insight and suggestions related to your question but won’t respond further here. if you have a new question, please ask a new question.

anonymous · December 4, 2020, 9:30pm

Hi @Dino-at-Google

I am unable to publish a new question due to a error on your site.
Something is wrong, it rejects my attempts, I tried in several browsers and had the same error:

dchiesa1 · December 8, 2020, 1:30am

That’s unfortunate. I’m sorry.

We are having some problems with the site for some browsers. I have not been able to resolve that problem.

Topic		Replies	Views
GenerateJWT failing again when using password protected private key Apigee api-runtime	6	5	January 28, 2020
Generate Private key from Certificate using password for JWT Apigee api-runtime	3	1	October 16, 2018
Private key encryption for JWT token generation Apigee api-runtime	12	15	January 4, 2022

Failing to generate JWT using a password protected private key.

AI Suggested topics