Function Compute (2.0):Configure JWT authentication for an HTTP trigger

1. Log on to the Function Compute console. In the left-side navigation pane, click Services & Functions.

2. In the top navigation bar, select a region. On the Services page, click the desired service.

3. On the Functions page, click the name of the desired function. On the Function Details page that appears, click the Trigger Management (URL) tab.

4. On the Trigger Management (URL) tab, click Modify in the Actions column of the HTTP trigger.

5. In the Modify Trigger panel, configure the following parameters and click OK.

   1. Set Authentication Method to JWT Authentication.

      

   2. Configure JWKS.

      To configure JWT authentication for the HTTP trigger, you must provide a valid JWKS. You can manually prepare a JWKS, or search for JSON Web Key generator in a web browser to use an online generator, such as mkjwk.org. If you have a key in the Privacy Enhanced Mail (PEM) format, you can use a tool such as jwx to convert the key to the JWKS format.

      In this example, mkjwk.org is used to generate JWKS. On the page for generating JWKS, set Show X.509 to Yes to view the private keys. If you want to use a private key to issue a JWT in your code, keep it secure. You can copy the content of the public key to the keys array of JWKS in the Function Compute console. The following figure shows the details.

      

      Sample code:

      {
          "keys": [
              {
                  "alg": "RS256",
                  "e": "AQAB",
                  "kty": "RSA",
                  "n": "u1LWgoomekdOMfB1lEe96OHehd4XRNCbZRm96RqwOYTTc28Sc_U5wKV2umDzolfoI682ct2BNnRRahYgZPhbOCzHYM6i8sRXjz9Ghx3QHw9zrYACtArwQxrTFiejbfzDPGdPrMQg7T8wjtLtkSyDmCzeXpbIdwmxuLyt_ahLfHelr94kEksMDa42V4Fi5bMW4cCLjlEKzBEHGmFdT8UbLPCvpgsM84JK63e5ifdeI9NdadbC8ZMiR--dFCujT7AgRRyMzxgdn2l-nZJ2ZaYzbLUtAW5_U2kfRVkDNa8d1g__2V5zjU6nfLJ1S2MoXMgRgDPeHpEehZVu2kNaSFvDUQ",
                  "use": "sig"
              }
          ]
      }

   3. In the JWT Token Configuration section, select the read position of the token and the name of the token.

      You can set the Read Position parameter of the token to Header, Cookie, Query Parameters, or Form Parameters. If you set the Read Position parameter of the token to Header, you must specify a prefix that you want to remove when Function Compute obtains the token.

   4. In the JWT Claim Conversion section, select the position to pass parameters to the function, the original name of the parameter, and the new name of the parameter after the parameter is passed to the function.

      You can set the Mapping Parameter Position parameter to Header, Cookie, Query Parameters, or Form Parameters.

   5. Specify the request matching mode.

      • Match All: All HTTP requests must be verified by using JWT.

      • Whitelist Mode: HTTP requests that are sent from the paths specified in Whitelist of Request Paths are not verified by using JWT. Other requests are verified by using JWT.

      • Blacklist Mode: HTTP requests that are sent from the paths specified in Blacklist of Request Paths are verified by using JWT. Other requests are not verified by using JWT.

      Whitelist Mode and Blacklist Mode support the following matching modes:

      • Exact match

        A path is matched only if the path is exactly the same as the specified path. For example, if you set the Blacklist of Request Paths parameter to /a, JWT verification is required for requests that are sent from /a. JWT verification is not required for requests that are sent from /a/.

      • Fuzzy match

        You can set the value to a path that is appended with an asterisk wildcard (*). For example, if you set the Blacklist of Request Paths parameter to /login/*, requests that are sent from the paths prefixed with /login/, such as /login/a and /login/b/c/d, are verified by using JWT.

This section describes whether HTTP services can be accessed as expected by using a tool based on the configurations of an HTTP trigger, such as the Internet endpoint, internal endpoint, and token. In this section, Postman is used for debugging and testing.

1. Use the private key generated in Step 1 to create a JWT.

2. Use Postman to verify whether an HTTP service is accessible.

   1. On the Trigger Management (URL) tab of the function that you want to manage, obtain the Internet endpoint of the HTTP trigger. Then, enter the endpoint in the address bar on the Postman page.

   2. Configure the parameters of a token in the headers of Postman. The following table describes the configuration of the token.

      Parameter	Value	Description
      Key	Authentication	The name of the token that you specified in the JWT Token Configuration section.
      Value	Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9uIFNub3ciLCJhZG1pbiI6dHJ1ZSwiZXhwIjo0ODI5NTk3NjQxfQ.eRcobbpjAd3OSMxcWbmbicOTLjO2vuLR9F2QZMK4rz1JqfSRHgwQVqNxcfOIO9ckDMNlF_3jtdfCfvXfka-phJZpHmnaQJxmnOA8zA3R4wF4GUQdz5zkt74cK9jLAXpokwrviz2ROehwxTCwa0naRd_N9eFhvTRnP3u7L0xn3ll4iOf8Q4jS0mVLpjyTa5WiBkN5xi9hkFxd__p98Pah_Yf0hVQ2ldGSyTtAMmdM1Bvzad-kdZ_wW0jcctIla9bLnOo-Enr14EsGvziMh_QTZ3HQtJuToSKZ11xkNgaz7an5de6PuF5ISXQzxigpFVIkG765aEDVtEnFkMO0xyPGLg	The header used to read the token. You must leave a space between the prefix to be removed and the token. The header part that excludes the prefix is used as the token.

   3. Click Send to view the returned information of the HTTP service. The following information is returned:

      

      In the returned information, nametofunction indicates the name that is passed to the function by Claim.