Does NATS support JWT-SVID authentication?

[AlexHu0208]

I am wondering if it is possible to use SPIFFE JWT-SVIDs for NATS authentication. Can we use the SPIFFE/SPIRE generated identities as the NATS identities?

Highly appreciate your help.

[wallyqs]

yes, there is basic support for this in the server:

nats-server/test/tls_test.go

Lines 1704 to 1742 in f90ef7b

	"connect with tls using certificate with URIs",
	`
	port: -1
	%s
	authorization {
	users = [
	{
	user = "spiffe://localhost/my-nats-service/user-a"
	}
	]
	}
	`,
	nats.ClientCert("./configs/certs/svid/client-a.pem", "./configs/certs/svid/client-a.key"),
	nil,
	nil,
	},
	{
	"connect with tls using certificate with limited different permissions",
	`
	port: -1
	%s
	authorization {
	users = [
	{
	user = "spiffe://localhost/my-nats-service/user-a"
	},
	{
	user = "spiffe://localhost/my-nats-service/user-b"
	permissions = { subscribe = { deny = ">" }}
	}
	]
	}
	`,
	nats.ClientCert("./configs/certs/svid/client-b.pem", "./configs/certs/svid/client-b.key"),
	nil,
	errors.New("nats: timeout"),
	},

[AlexHu0208]

Thanks for the quick reply. I have 2 follow-up questions

1. I can still use the same private key as what I did for the non-SPIFFE/SPIRE JWT to connect to the NATS server, correct?

nc, err := nats.Connect(url, nats.UserJWT(jwtCB, sigCB))

2. For the authorization, do I need to inject the pub/sub claims into the SPIRE?

I am still learning the SPIFFE/SPIRE and JWT-SVID, hope these questions make sense.

[wallyqs]

ah sorry my mistake, no there is no support for JWT-SVIDs at the moment, only basic support for X509-SVID:
https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md

[AlexHu0208]

No worries! Thanks for the clarification! Is there any plan to support JWT-SVID in the near future?