mirror of
https://github.com/temporalio/temporal.git
synced 2026-08-30 18:41:49 -07:00
d12d4a4bac
## What changed? - Added `development-jwt.yaml` config that runs Temporal with JWT authorization enabled using a JWKS file loaded from local disk. Loading from local disk is added in https://github.com/temporalio/temporal/pull/9590. - Added `config/jwt/setup-keys.sh` to generate an RSA key pair and JWKS file in `/tmp/temporal-jwt-test/`. - Added `config/jwt/generate-token.sh` to create signed JWTs for testing. - Added `make start-jwt` target. ## Why? Testing JWT authentication currently requires an external identity provider or manual key/token setup. This provides a self-contained local workflow: `make start-jwt` generates keys automatically and starts the server with auth enforced, and `generate-token.sh` produces tokens on demand. ## How did you test it? - [X] built - [X] run locally and tested manually - [ ] covered by existing tests - [ ] added new unit test(s) - [ ] added new functional test(s) Tested this in conjunction with https://github.com/temporalio/temporal/pull/9582. Was able to list the workflows by passing the token and dumping their history. When the token is not used, the auth fails with "Request denied". ## Potential risks Keys are stored in /tmp/temporal-jwt-test/ which is world-readable. This is acceptable for local development but the scripts should not be used in shared or production environments.
151 lines
3.2 KiB
YAML
151 lines
3.2 KiB
YAML
log:
|
|
stdout: true
|
|
level: info
|
|
|
|
persistence:
|
|
defaultStore: sqlite-default
|
|
visibilityStore: sqlite-visibility
|
|
numHistoryShards: 1
|
|
datastores:
|
|
sqlite-default:
|
|
sql:
|
|
user: ""
|
|
password: ""
|
|
pluginName: "sqlite"
|
|
databaseName: "default"
|
|
connectAddr: "localhost"
|
|
connectProtocol: "tcp"
|
|
connectAttributes:
|
|
mode: "memory"
|
|
cache: "private"
|
|
maxConns: 1
|
|
maxIdleConns: 1
|
|
maxConnLifetime: "1h"
|
|
tls:
|
|
enabled: false
|
|
caFile: ""
|
|
certFile: ""
|
|
keyFile: ""
|
|
enableHostVerification: false
|
|
serverName: ""
|
|
|
|
sqlite-visibility:
|
|
sql:
|
|
user: ""
|
|
password: ""
|
|
pluginName: "sqlite"
|
|
databaseName: "default"
|
|
connectAddr: "localhost"
|
|
connectProtocol: "tcp"
|
|
connectAttributes:
|
|
mode: "memory"
|
|
cache: "private"
|
|
maxConns: 1
|
|
maxIdleConns: 1
|
|
maxConnLifetime: "1h"
|
|
tls:
|
|
enabled: false
|
|
caFile: ""
|
|
certFile: ""
|
|
keyFile: ""
|
|
enableHostVerification: false
|
|
serverName: ""
|
|
global:
|
|
membership:
|
|
maxJoinDuration: 30s
|
|
broadcastAddress: "127.0.0.1"
|
|
pprof:
|
|
port: 7936
|
|
metrics:
|
|
prometheus:
|
|
# # specify framework to use new approach for initializing metrics and/or use opentelemetry
|
|
# framework: "opentelemetry"
|
|
framework: "tally"
|
|
timerType: "histogram"
|
|
listenAddress: "127.0.0.1:8000"
|
|
authorization:
|
|
authorizer: "default"
|
|
claimMapper: "default"
|
|
jwtKeyProvider:
|
|
keySourceURIs:
|
|
- "file:///tmp/temporal-jwt-test/.well-known/jwks.json"
|
|
|
|
services:
|
|
frontend:
|
|
rpc:
|
|
grpcPort: 7233
|
|
membershipPort: 6933
|
|
bindOnLocalHost: true
|
|
httpPort: 7243
|
|
|
|
internal-frontend:
|
|
rpc:
|
|
grpcPort: 7236
|
|
membershipPort: 6936
|
|
bindOnLocalHost: true
|
|
|
|
matching:
|
|
rpc:
|
|
grpcPort: 7235
|
|
membershipPort: 6935
|
|
bindOnLocalHost: true
|
|
|
|
history:
|
|
rpc:
|
|
grpcPort: 7234
|
|
membershipPort: 6934
|
|
bindOnLocalHost: true
|
|
|
|
worker:
|
|
rpc:
|
|
grpcPort: 7239
|
|
membershipPort: 6939
|
|
bindOnLocalHost: true
|
|
|
|
clusterMetadata:
|
|
enableGlobalNamespace: false
|
|
failoverVersionIncrement: 10
|
|
masterClusterName: "active"
|
|
currentClusterName: "active"
|
|
clusterInformation:
|
|
active:
|
|
enabled: true
|
|
initialFailoverVersion: 1
|
|
rpcName: "frontend"
|
|
rpcAddress: "localhost:7233"
|
|
httpAddress: "localhost:7243"
|
|
|
|
dcRedirectionPolicy:
|
|
policy: "noop"
|
|
|
|
archival:
|
|
history:
|
|
state: "enabled"
|
|
enableRead: true
|
|
provider:
|
|
filestore:
|
|
fileMode: "0666"
|
|
dirMode: "0766"
|
|
gstorage:
|
|
credentialsPath: "/tmp/gcloud/keyfile.json"
|
|
visibility:
|
|
state: "enabled"
|
|
enableRead: true
|
|
provider:
|
|
filestore:
|
|
fileMode: "0666"
|
|
dirMode: "0766"
|
|
|
|
namespaceDefaults:
|
|
archival:
|
|
history:
|
|
state: "disabled"
|
|
URI: "file:///tmp/temporal_archival/development"
|
|
visibility:
|
|
state: "disabled"
|
|
URI: "file:///tmp/temporal_vis_archival/development"
|
|
|
|
dynamicConfigClient:
|
|
filepath: "config/dynamicconfig/development-sql.yaml"
|
|
pollInterval: "10s"
|