Skip to main content

Privacera Platform

JSON Web Tokens (JWT)
:

This topic shows how to authenticate Privacera services using JSON web tokens (JWT).

Supported services:

Prerequisites

Ensure the following prerequisites are met:

  • Get the identity provider URL that is allowed in the issuer claim of a JWT.

  • Get the public key from the provider that Privacera services can use to validate JWT.

Configuration

  1. SSH to the instance as USER.

  2. Copy the public key in ~/privacera/privacera-manager/config/custom-properties folder. If you are configuring more than one JWT, then copy all the public keys associated with the JWT tokens to the same path.

  3. Run the following commands.

    cd ~/privacera/privacera-manager/config
cp sample-vars/vars.jwt-auth.yaml custom-vars
vi custom-vars/vars.jwt-auth.yaml

  4. Edit the properties.

    Table 5. JWT Properties

    Property

    Description

    Example

    JWT_OAUTH_ENABLE

    Property to enable JWT auth in Privacera services.

    TRUE

    JWT_CONFIGURATION_LIST

    Property to set multiple JWT configurations.

    • issuer: URL of the identity provider.

    • subject: Subject of the JWT (the user).

    • secret: If the JWT token has been encrypted using secret.

    • publickey: JWT file name that you copied in step 2 above.

    • userKey: Define a unique userkey.

    • groupKey: Define a unique group key.

    • parserType:  Assign one of the following values.

      • PING_IDENTITY: When scope/group is array.

      • KEYCLOAK: When scope/group is space separator.

    JWT_CONFIGURATION_LIST:
  - index: 0
    issuer: "https://your-idp-domain.com/websec"
    subject: "api-token"
    secret: "tprivacera-api"
    publickey: "jwttoken.pub"
    userKey: "client_id"
    groupKey: "scope"
    parserType: "KEYCLOAK"
  - index: 1
    issuer: "https://your-idp-domain.com/websec2"
    publickey: "jwttoken2.pub"
    parserType: "PING_IDENTITY"
  - index: 2
    issuer: "https://your-idp-domain.com/websec3"
    publickey: "jwttoken3.pub"


  5. Run the update.

    cd ~/privacera/privacera-manager/

./privacera-manager.sh update
JWT for Databricks
Configure

To configure JWT for Databricks, do the following:

  1. Enable JWT. To enable JWT, refer Configuration.

  2. (Optional) Create a JWT, if you do not have one. Skip this step, if you already have an existing token.

    To create a token, see JWT and use the following details. For more details, refer the JWT docs.

    • Algorithm=RSA256

    • When JWT_PARSER_TYPE is KEYCLOAKS (scope/group is space separator)

      {
"scope": "jwt:role1 jwt:role2",
"client_id": "privacera-test-jwt-user",
"iss": "privacera","exp": <PLEASE_UPDATE>
}

    • When JWT_PARSER_TYPE is PING_IDENTITY (scope/group is array)

      {
"scope": [
    "jwt:role1",
    "jwt:role1"
],
"client_id": "privacera-test-jwt-user",
"iss": "privacera",
"exp": <PLEASE_UPDATE>
}

    • Paste public/private key in input box.

    • Copy the generated JWT Token.

  3. Log in to Databricks portal and write the following JWT file in a cluster file. Then the Privacera plugin can read and perform access-control based on the token user.

    %python
JWT_TOKEN="<PLEASE_UPDATE>"
TOKEN_LOCAL_FILE="/tmp/ptoken.dat"
f = open(TOKEN_LOCAL_FILE, "w")
f.write(JWT_TOKEN)
f.close()
Use case

Reading files from the cloud using JWT token

  1. Read the files in the file explorer of your cloud provider from your notebook. Depending on your cloud provider, enter the location of your cloud files in the <path-to-your-cloud-files>.

                    %python spark.read.csv("<path-to-your-cloud-files>").show()

  2. Check the audits. To learn how to check the audits, click here.

    You should get JWT user (privacera-test-jwt-user) which was specified in the payload while creating the JWT.

  3. To give permissions on a resource, create a group in Privacera Portal similar to the scope of the JWT payload and give access to the group, It's not necessary to create a user.

    Privacera plugin extracts the JWT payload and passes the group during access check. In other words, it takes user-group mapping from JWT payload itself, so it's not required to do user-group mapping in Privacera.

JWT for EMR FGAC Spark
Prerequisite
Configuration Steps

  1. First enable JWT, see Configuration above.

  2. Open the vars.emr.yml file.

    cd ~/privacera/privacera-managervi 
config/custom-vars/vars.emr.yml

  3. Add following property to enable JWT for EMR.

    EMR_JWT_OAUTH_ENABLE: "true"

  4. Run the update.

    cd ~/privacera/privacera-manager/ 

./privacera-manager.sh update
Validations with JWT Token

  1. Create a JWT, see Step 2 above.

  2. SSH to the EMR master node.

  3. Configure the Spark application as follows:

    JWT_TOKEN=eyJhbGciOiJSU-XXXXXX–X2BAIGWTbywHkfTxxw
spark-sql --conf "spark.hadoop.privacera.jwt.token.str=${JWT_TOKEN}" --conf "spark.hadoop.privacera.jwt.oauth.enable=true"