rust/neon
1
0
Fork 0
mirror of https://github.com/neondatabase/neon.git synced 2026-05-27 18:10:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Switch to EdDSA algorithm for the storage JWT authentication tokens.

Browse Source 
The control plane currently only supports EdDSA. We need to either teach
the storage to use EdDSA, or the control plane to use RSA. EdDSA is more
modern, so let's use that.

We could support both, but it would require a little more code and tests,
and we don't really need the flexibility since we control both sides.
This commit is contained in:
Heikki Linnakangas
2023-03-20 15:50:30 +02:00
committed by Heikki Linnakangas
parent 77107607f3
commit fea4b5f551
6 changed files with 49 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
docs/authentication.md
View File

@@ -29,15 +29,22 @@ These components should not have access to the private key and may only get toke
The key pair is generated once for an installation of compute/pageserver/safekeeper, e.g. by `neon_local init`.
There is currently no way to rotate the key without bringing down all components.
### Best practices
See [RFC 8725: JSON Web Token Best Current Practices](https://www.rfc-editor.org/rfc/rfc8725)
### Token format
The JWT tokens in Neon use RSA as the algorithm. Example:
The JWT tokens in Neon use "EdDSA" as the algorithm (defined in [RFC8037](https://www.rfc-editor.org/rfc/rfc8037)).
Example:
Header:
```
{
"alg": "RS512", # RS256, RS384, or RS512
"alg": "EdDSA",
"typ": "JWT"
}
```
@@ -68,8 +75,8 @@ Currently also used for connection from any pageserver to any safekeeper.
CLI generates a key pair during call to `neon_local init` with the following commands:
```bash
openssl genrsa -out auth_private_key.pem 2048
openssl rsa -in auth_private_key.pem -pubout -outform PEM -out auth_public_key.pem
openssl genpkey -algorithm ed25519 -out auth_private_key.pem
openssl pkey -in auth_private_key.pem -pubout -out auth_public_key.pem
```
Configuration files for all components point to `public_key.pem` for JWT validation.