JSON Web Key Sets (JWKS)

Detailed information on the JWKS cryptography component

Component format

The purpose of this component is to load keys from a JSON Web Key Set (RFC 7517). These are JSON documents that contain 1 or more keys as JWK (JSON Web Key); they can be public, private, or shared keys.

This component supports loading a JWKS:

  • From a local file; in this case, Dapr watches for changes to the file on disk and reloads it automatically.
  • From a HTTP(S) URL, which is periodically refreshed.
  • By passing the actual JWKS in the jwks metadata property, as a string (optionally, base64-encoded).

Note

This component uses the cryptographic engine in Dapr to perform operations. Although keys are never exposed to your application, Dapr has access to the raw key material.

A Dapr crypto.yaml component file has the following structure:

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4. name: jwks
  5. spec:
  6. type: crypto.dapr.jwks
  7. version: v1
  8. metadata:
  9. # Example 1: load JWKS from file
  10. - name: "jwks"
  11. value: "fixtures/crypto/jwks/jwks.json"
  12. # Example 2: load JWKS from a HTTP(S) URL
  13. # Only "jwks" is required
  14. - name: "jwks"
  15. value: "https://example.com/.well-known/jwks.json"
  16. - name: "requestTimeout"
  17. value: "30s"
  18. - name: "minRefreshInterval"
  19. value: "10m"
  20. # Option 3: include the actual JWKS
  21. - name: "jwks"
  22. value: |
  23. {
  24. "keys": [
  25. {
  26. "kty": "RSA",
  27. "use": "sig",
  28. "kid": "…",
  29. "n": "…",
  30. "e": "…",
  31. "issuer": "https://example.com"
  32. }
  33. ]
  34. }
  35. # Option 3b: include the JWKS base64-encoded
  36. - name: "jwks"
  37. value: |
  38. eyJrZXlzIjpbeyJ

Warning

The above example uses secrets as plain strings. It is recommended to use a secret store for the secrets, as described here.

Spec metadata fields

FieldRequiredDetailsExample
jwksYPath to the JWKS documentLocal file: “fixtures/crypto/jwks/jwks.json”
HTTP(S) URL: https://example.com/.well-known/jwks.json
Embedded JWKS: {“keys”: […]} (can be base64-encoded)
requestTimeoutNTimeout for network requests when fetching the JWKS document from a HTTP(S) URL, as a Go duration. Default: “30s”“5s”
minRefreshIntervalNMinimum interval to wait before subsequent refreshes of the JWKS document from a HTTP(S) source, as a Go duration. Default: “10m”“1h”

Cryptography building block

Last modified June 19, 2023: Merge pull request #3565 from dapr/aacrawfi/skip-secrets-close (b1763bf)