mirror of
https://github.com/temporalio/temporal.git
synced 2026-08-31 02:51:51 -07:00
d12d4a4bac
## What changed? - Added `development-jwt.yaml` config that runs Temporal with JWT authorization enabled using a JWKS file loaded from local disk. Loading from local disk is added in https://github.com/temporalio/temporal/pull/9590. - Added `config/jwt/setup-keys.sh` to generate an RSA key pair and JWKS file in `/tmp/temporal-jwt-test/`. - Added `config/jwt/generate-token.sh` to create signed JWTs for testing. - Added `make start-jwt` target. ## Why? Testing JWT authentication currently requires an external identity provider or manual key/token setup. This provides a self-contained local workflow: `make start-jwt` generates keys automatically and starts the server with auth enforced, and `generate-token.sh` produces tokens on demand. ## How did you test it? - [X] built - [X] run locally and tested manually - [ ] covered by existing tests - [ ] added new unit test(s) - [ ] added new functional test(s) Tested this in conjunction with https://github.com/temporalio/temporal/pull/9582. Was able to list the workflows by passing the token and dumping their history. When the token is not used, the auth fails with "Request denied". ## Potential risks Keys are stored in /tmp/temporal-jwt-test/ which is world-readable. This is acceptable for local development but the scripts should not be used in shared or production environments.
Local JWT Development Setup
This document describes how to run Temporal server locally with JWT authentication enabled for test and development purposes.
Overview
The setup uses:
- RSA key pair for signing/verifying JWTs
- JWKS file loaded directly from disk via
file://URI - Custom config file
development-jwt.yamlwith authorization enabled
Files
config/development-jwt.yaml- Server config with JWT auth enabledconfig/jwt/setup-keys.sh- Generates RSA key pair and JWKSconfig/jwt/generate-token.sh- Helper script to generate test JWTs
Generated files (created by setup-keys.sh in /tmp/temporal-jwt-test/):
/tmp/temporal-jwt-test/private-key.pem- RSA private key for signing test JWTs/tmp/temporal-jwt-test/.well-known/jwks.json- JWKS file with RSA public key
Makefile Targets
make start-jwt- Start Temporal with JWT auth (no--allow-no-authflag)
Usage
1. Start Temporal with JWT Auth
make start-jwt
Note: Unlike other start-* targets, this does NOT use the --allow-no-auth flag, so authentication is enforced.
2. Generate Test JWTs
# Default: test-user@example.com with system:admin
./config/jwt/generate-token.sh
# Custom subject with system:admin
./config/jwt/generate-token.sh alice@company.com
# Custom subject with namespace permission
./config/jwt/generate-token.sh alice@company.com default:admin
# Multiple permissions
./config/jwt/generate-token.sh alice@company.com system:admin default:writer
3. Use the Token
TOKEN=$(./config/jwt/generate-token.sh alice@example.com default:admin)
temporal --tls=false --api-key "$TOKEN" workflow list