JWT for System API Call

F

FFO•8/26/24, 12:52 AM

Hm I am not aware of a problem, where did you test the token on zitadel cloud or self-hosted?

F

FFO•8/26/24, 10:30 PM

Can you share how you configured stuff?

F

FFO•8/27/24, 11:05 PM

Hm, that is still weird, can you share the token without signature with me?

F

FFO•8/28/24, 9:44 PM

I think I got an idea... what API do you try to call with this token?

F

FFO•8/30/24, 11:13 PM

And that call gives you the error when you send you token along?

F

FFO•8/30/24, 11:13 PM

Its kind of weird, I would have expected that from all other apis but not this one

F

FFO•9/23/24, 12:45 PM

Hey I looked at this again... but we all do not see where it goes wrong.

I followed the docs and it worked on my end :sweat_smile_monkey:

F

FFO•9/23/24, 12:46 PM

It looks to me that when generating the JWT to access the system api it uses a wrong value.

Can you share me that? (can be a DM or an expired token)

2

2isprime•9/24/24, 4:37 PM

@FFO , facing the same issue ...... getting the same error when followed the docs.
sharing the token here:

eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJzeXN0ZW0tdXNlci0xIiwic3ViIjoic3lzdGVtLXVzZXItMSIsImF1ZCI6WyJodHRwOi8vbG9jYWxob3N0OjgwODAiXSwiaWF0IjoxNzI3MTg3NDc1LCJleHAiOjE3MjcxOTEwNzV9.sastkxMQlQBGXqipXFYm7rwHTAjSOx_rtkCvh-wlTr0jMmvbKjYzWrIr17sOiaZa3LHWfe3s3Kuq2yal8BdRn0RKgqNKkQK1HwLq7AUsm4ozXMHAD8g7L-hoVKXIztJXaoQcgF9dDPAy4ni8zuKh-eYNZeFNQw9LlzLTTRCbYkDrBHWodNDQiJEevXoOe9Oun1gTX3c_1GQ1QhxQ8gXRR10zH4RL2R9Sp1dpeo_J24z4JNoOn296H2hQWuGAgN6wHenUfJmrG5J22pLEICUgBz4aFjRGy90zex6OBmm3I1b8tsinFG3EbhmlQPqP2ZWGZo7_8o2mdGvx6RmB49e3qg

F

FFO•9/24/24, 5:00 PM

Ok let me look into this again, I should have time tomorrow

2

2isprime•9/25/24, 6:24 AM

sharing more details on this:

Create a docker container following steps here : https://zitadel.com/docs/self-hosting/manage/configure
Changed the example-zitadel-config.yaml :

# All possible options and their defaults: https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
Log:
  Level: 'info'

# Make ZITADEL accessible over HTTP, not HTTPS
ExternalSecure: false

# If not using the docker compose example, adjust these values for connecting ZITADEL to your PostgreSQL
Database:
  postgres:
    Host: 'db'
    Port: 5432
    Database: zitadel
    User:
      SSL:
        Mode: 'disable'
    Admin:
      SSL:
        Mode: 'disable'

SystemAPIUsers:
  - system-user-1:
      Path: /system-user-1.pub
      Memberships:
       # MemberType System allows the user to access all APIs for all instances or organizations
       - MemberType: System
         Roles:
           - "SYSTEM_OWNER"
           - "IAM_OWNER"
           - "ORG_OWNER"

# All possible options and their defaults: https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
Log:
  Level: 'info'

# Make ZITADEL accessible over HTTP, not HTTPS
ExternalSecure: false

# If not using the docker compose example, adjust these values for connecting ZITADEL to your PostgreSQL
Database:
  postgres:
    Host: 'db'
    Port: 5432
    Database: zitadel
    User:
      SSL:
        Mode: 'disable'
    Admin:
      SSL:
        Mode: 'disable'

SystemAPIUsers:
  - system-user-1:
      Path: /system-user-1.pub
      Memberships:
       # MemberType System allows the user to access all APIs for all instances or organizations
       - MemberType: System
         Roles:
           - "SYSTEM_OWNER"
           - "IAM_OWNER"
           - "ORG_OWNER"

# All possible options and their defaults: https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
Log:
  Level: 'info'

# Make ZITADEL accessible over HTTP, not HTTPS
ExternalSecure: false

# If not using the docker compose example, adjust these values for connecting ZITADEL to your PostgreSQL
Database:
  postgres:
    Host: 'db'
    Port: 5432
    Database: zitadel
    User:
      SSL:
        Mode: 'disable'
    Admin:
      SSL:
        Mode: 'disable'

SystemAPIUsers:
  - system-user-1:
      Path: /system-user-1.pub
      Memberships:
       # MemberType System allows the user to access all APIs for all instances or organizations
       - MemberType: System
         Roles:
           - "SYSTEM_OWNER"
           - "IAM_OWNER"
           - "ORG_OWNER"

# All possible options and their defaults: https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
Log:
  Level: 'info'

# Make ZITADEL accessible over HTTP, not HTTPS
ExternalSecure: false

# If not using the docker compose example, adjust these values for connecting ZITADEL to your PostgreSQL
Database:
  postgres:
    Host: 'db'
    Port: 5432
    Database: zitadel
    User:
      SSL:
        Mode: 'disable'
    Admin:
      SSL:
        Mode: 'disable'

SystemAPIUsers:
  - system-user-1:
      Path: /system-user-1.pub
      Memberships:
       # MemberType System allows the user to access all APIs for all instances or organizations
       - MemberType: System
         Roles:
           - "SYSTEM_OWNER"
           - "IAM_OWNER"
           - "ORG_OWNER"

Followed the steps to generate RSA key pair : https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-system-api#runtime-configuration
Used the command to generate JWT:
zitadel-tools key2jwt --audience=http://localhost:8080 --key=system-user-1.pem --issuer=system-user-1
or
zitadel-tools key2jwt --audience=http://localhost --key=system-user-1.pem --issuer=system-user-1
or
zitadel-tools key2jwt --audience=localhost --key=system-user-1.pem --issuer=system-user-1

Used the generated JWT with below endpoint:

curl --request POST \
--url $CUSTOM-DOMAIN/system/v1/instances/_search \
--header 'Authorization: Bearer {token}' \
--header 'Content-Type: application/json'

curl --request POST \
--url $CUSTOM-DOMAIN/system/v1/instances/_search \
--header 'Authorization: Bearer {token}' \
--header 'Content-Type: application/json'

curl --request POST \
--url $CUSTOM-DOMAIN/system/v1/instances/_search \
--header 'Authorization: Bearer {token}' \
--header 'Content-Type: application/json'

curl --request POST \
--url $CUSTOM-DOMAIN/system/v1/instances/_search \
--header 'Authorization: Bearer {token}' \
--header 'Content-Type: application/json'

The API response is :

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

{
    "code": 16,
    "message": "Errors.Token.Invalid (AUTH-7fs1e)",
    "details": [
        {
            "@type": "type.googleapis.com/zitadel.v1.ErrorDetail",
            "id": "AUTH-7fs1e",
            "message": "Errors.Token.Invalid"
        }
    ]
}

ZITADEL Docs

This guide assumes you are familiar with running ZITADEL using the least amount of configuration possible.

ZITADEL Docs

This guide focuses on the ZITADEL System API. To access the other APIs (Admin, Auth, Management), please checkout this guide.

2

2isprime•9/25/24, 6:25 AM

and the logs say:

2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:282" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:286" error="issuer does not match: Expected: http://, got: system-user-1"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:282" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:286" error="issuer does not match: Expected: http://, got: system-user-1"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:282" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:286" error="issuer does not match: Expected: http://, got: system-user-1"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:282" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:286" error="issuer does not match: Expected: http://, got: system-user-1"
2024-09-25 01:01:49 time="2024-09-24T21:01:49Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

2

2isprime•9/25/24, 6:26 AM

@FFO , your help here would be really appreciated to help us unblock

2

2isprime•9/25/24, 7:39 AM

@FFO , worked

changed the docker image from

image: "ghcr.io/zitadel/zitadel:stable"
to
image: "ghcr.io/zitadel/zitadel:v2.62.2"

2

2isprime•9/25/24, 7:51 AM

but I still see the logs:

2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:283" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:287" error="issuer does not match: Expected: http://localhost:8080, got: system-user-1"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:283" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:287" error="issuer does not match: Expected: http://localhost:8080, got: system-user-1"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:283" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:287" error="issuer does not match: Expected: http://localhost:8080, got: system-user-1"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: decrypt access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:283" error="ID=APP-ASdgg Message=invalid token"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="token verifier repo: verify JWT access token" caller="/home/runner/work/zitadel/zitadel/internal/authz/repository/eventsourcing/eventstore/token_verifier.go:287" error="issuer does not match: Expected: http://localhost:8080, got: system-user-1"
2024-09-25 11:50:30 zitadel-1  | time="2024-09-25T07:50:30Z" level=warning msg="authz: verify access token" caller="/home/runner/work/zitadel/zitadel/internal/api/authz/context.go:112" error="ID=APP-Reb32 Message=invalid token" org_domain= org_id=

although the API's work, any idea?

22isprime @FFO , worked 💯 changed the docker image from image: "ghcr.io/zitadel/zitad...