JWT auth in ejabberd

Question

I have configured ejabberd service to use jwt token for authenticating users by following this doc ejabberd authentication. In ejabberd.yml file, I have configured auth mechanism as below

`auth_method: [jwt, sql]
 jwt_key: /usr/local/etc/ejabberd/secret.jwk
  default_db: sql
 new_sql_schema: true
 sql_type: mysql


 access_rules:
   jwt_only:
     deny: admin
     allow: all
   local:
     allow: all
   c2s:
     deny: blocked
     allow: all
   announce:
     allow: admin
   configure:
     allow: admin
   muc_create:
     allow: all
   pubsub_createnode:
     allow: local
   trusted_network:
     allow: loopback

  jwt_auth_only_rule: jwt_only

`

. Created jwt token for a user from jwt.io and passed that token as a password while connecting to ejabberd through strophe.connect() as stated in this doc. But still the authentication fails with this log

 Send XML on stream = <<"<failure xmlns='urn:ietf:params:xml:ns:xmpp-sasl'><not-authorized/><text xml:lang='en'>Invalid username or password</text></failure>">>

Have anyone faced this issue and managed to solve this?

TIA!

Answer 1

For anyone who is stuck in this, I was able to authenticate using jwt token with the below config

Signed the JWT using "k", placed key set `

"keys": [
    {
        "kty": "oct",
        "use": "sig",
        "kid": "",
        "k": "",
        "alg": "HS256"
    }
]

` in secret.jwk. And after passing jabber id & jwt token in strophe.connect() it got connected. this is the backend configuration I had

      `auth_method: [jwt, sql]
       jwt_key: /usr/local/etc/ejabberd/secret.jwk
       default_db: sql
       new_sql_schema: true
       sql_type: mysql

       access_rules:
       jwt_only:
        deny: admin
        allow: all
       local:
        allow: all
       c2s:
         deny: blocked
         allow: all
       announce:
         allow: admin
      configure:
        allow: admin
      muc_create:
        allow: all
      pubsub_createnode:
       allow: local
      trusted_network:
       allow: loopback

     jwt_auth_only_rule: jwt_only`