It seems a good idea to support JWT as a new SIP authorization method. Wonder if anyone is interested? Think auth_db would be the best spot to add support for JWT.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29
auth_db is intended for providing the authentication functions with database backend. It is better to write a new module for JWT. Such module can be useful to use in the context of webrtc.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-69724781
On 12 Jan 2015, at 21:34, mading087 notifications@github.com wrote:
It seems a good idea to support JWT as a new SIP authorization method. Wonder if anyone is interested? Think auth_db would be the best spot to add support for JWT.
Please check the work that is ongoing with OAuth - there is an IETF draft on that.
/O
I have been considering this for some time.
I think there should be a new auth_jwt module, probably based on auth_ephemeral (which is similar in concept). For SIP over WebSockets this can then be used to authenticate the client during the WebSocket handshake.
There should be a “Private Claim Name” defined to contain the identity of the calling/registering party. This can be cached during the WebSocket handshake and then used to valid the To-URI (REGISTER/PUBLISH) and From-URI (other requests without To-tags). The “Expiration Time Claim” should be cached too.
auth_jwt should contain helper functions for checking URIs and whether the token is still valid - similar to those in auth_ephemeral.
Regards,
Peter
— Peter Dunkley http://www.dunkley.me.uk/ http://www.dunkley.me.uk/ http://www.linkedin.com/in/pdunkley http://www.linkedin.com/in/pdunkley
On 13 Jan 2015, at 20:59, kamailio-sync notifications@github.com wrote:
On 12 Jan 2015, at 21:34, mading087 notifications@github.com wrote:
It seems a good idea to support JWT as a new SIP authorization method. Wonder if anyone is interested? Think auth_db would be the best spot to add support for JWT.
Please check the work that is ongoing with OAuth - there is an IETF draft on that.
/O — Reply to this email directly or view it on GitHub https://github.com/kamailio/kamailio/issues/29#issuecomment-69818698.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-69819723
Thanks for the comments. Think a new module auth_jwt is a better way. Will take a closer look at auth_ephemeral. The two IETF draft I was looking at are http://www.ietf.org/id/draft-ietf-oauth-json-web-token-32.txt http://www.ietf.org/id/draft-ietf-oauth-json-web-token-32.txt and http://www.ietf.org/id/draft-ietf-jose-json-web-signature-40.txt http://www.ietf.org/id/draft-ietf-jose-json-web-signature-40.txt. OAuth 2.0 is a nice framework to handle auth and issue web tokens. But maybe the first step is to use configured public keys to verify the token and then use info from the token to validate SIP messages. Another thing is that it seems we need a new SIP header to send the JWT token. Cannot find an existing header that is suitable for JWT.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-69868305
Daniel, Peter
I have developed the auth_jwt module, which can parse and validate SIP JSON tokens signed with SHA256 and RSA. Tested it for SIP REGISTER. I'd consider the implementation a preliminary module at this point. I haven't implemented the WebSocket handshake Peter described as our business case is more for SIP apps on mobile devices. I'd like to know the process to become a Kamailio developer so I can post the auth_jwt module for review. Hope more experienced Kamailio developers can point out my errors and provide ideas for enhancements.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-83005125
I'd like to know the process to become a Kamailio developer so I can post the auth_jwt module for >review. Hope more experienced Kamailio developers can point out my errors and provide ideas for >enhancements.
You just have to fork and send a pull-request to get auth_jwt reviewed. No need to become KD for that.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-83054737
To give more details about the procedure to get a new module and access as developer: * fork kamailio repository and put your new module inside it (recommended as you are already on github, otherwise we can retrieve the code on sr-dev mailing list) * make pull request so we can review the module to be sure it follows the rules of the project (e.g., GPLv2 or license compatible with it, coding style is acceptable, exiting functions from core are used instead of a duplicated implementation, the new module has the required xml docbook documentation) * if all is ok, then you are granted write access to kamailio repository and you can develop and push directly to this repository in the future
If you need other details, write here and we can assist. Looking forward to see the new module!
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-85226909
Just came back from Spring break. Thanks for the info. Some questions about module document and management interface. I was not sure if there is a common xml docbook tool, so I just made a text README file. Is this OK? Wonder if there is an xml tool I can use to convert the text file to xml docbook. I have read that the Kamailio MI interface is considered deprecated and should be supported only for backwards compatibility. New development should use RPC interface. Haven't written the management interface for the auth_jwt module, as I'm not sure if there are any guidelines on how to develop a RPC interface. Can someone point out such guidelines or an existing module with a good RPC interface implementation. Thanks
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-88120220
old devel guide: http://www.asipto.com/pub/kamailio-devel-guide/#c10rpc
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-88125971
I am not aware of tools converting from text to docbook xml, maybe google can reveal some.
The other way is the usual - write docbook files and then run: ``` make modules-readme modules=modules/auth_jwt ``` You need docbook tools/utils and xsl schemas installed. If not available for you, no problem, we can generate the readme and push to git repository.
Writing in docbook is rather simple, you can easily see the format from other modules -- look into the doc/ subfolder of each module. You need the Makefile from there, updated to reflect the name of your module. The look at the modulename.xml for the base file for the docbook of the module. Besides the author info and some other details, this file includes other files, the most common being modulename_admin.xml .
Thinking of a module that doesn't have large docbook and can be a good starting point: async
Some other notes about docbook files:
* http://www.kamailio.org/wiki/devel/module-docbook-readme
Regarding the RPC, do you need to add such commands?
Besides the link from Victor, check also the RPC API -- it might not be really up to date (maybe some new stuff missing), but what is there should be still valid:
* http://www.kamailio.org/docs/docbooks/4.2.x/rpc_api/rpc_api.html
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-88128225
A short note to say that development for 4.3 will be frozen on April 22, next week Wednesday. If you want to get the module in the next major version, make a pull request by that time. Once the code is reviewed and is clean, you will get developer access to maintain the module.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-93685573
Thanks for letting me know. I'll try my best. Have to go through internal review process to get anything published. Just in case I cannot get this out in time, we can try the next release. This module will be constantly changed when we start to get feedback from field trials.
On Thu, Apr 16, 2015 at 4:06 AM, Daniel-Constantin Mierla < notifications@github.com> wrote:
A short note to say that development for 4.3 will be frozen on April 22, next week Wednesday. If you want to get the module in the next major version, make a pull request by that time. Once the code is reviewed and is clean, you will get developer access to maintain the module.
— Reply to this email directly or view it on GitHub https://github.com/kamailio/kamailio/issues/29#issuecomment-93685573.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-93751931
Looks like we'll have to wait for the release after 4.3. Cannot get the internal code review through as we're busy developing a redundancy solution at the moment. Thanks
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-95291853
Any update?
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-145562293
Yes, we have made a new auth_jwt module that works with RSA256 tokens. The internal code review and licensing type of things are moving slow. Hope we can post it for review soon.
--- Reply to this email directly or view it on GitHub: https://github.com/kamailio/kamailio/issues/29#issuecomment-146042398
Closed #29.
No follow up for more than an year from @mading087 on the JWT module. I am closing this one. If somebody is considering to add a auth jwt module, then it can go ahead and just push a pull request.
I am writing a JWT module now. I'll create a pull request when it's ready.
+1
Hi @poldon & @bwiles-vysk ! I am interested in your pull request status. Could you give a feeback about it ? Thanks
Did the source for this ever get published?
I didn’t as I left the company where I developed the code.
Sent from my iPhone
On Oct 22, 2018, at 6:18 AM, Phil Lavin notifications@github.com wrote:
Did the source for this ever get published?
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.
OpenSIPS have **[AUTH_JWT](https://opensips.org/docs/modules/3.1.x/auth_jwt.html) module** now if any one is interested.
Thanks. There seems to be interest as shown from the individual private implementation, but not enought to actually getting it into the Kamailio repository. If somebody wants to take this up, just let us know.