Streams

To share messages you publish with other accounts, you have to Export a Stream. Exports are associated with the account performing the export and advertised in exporting account’s JWT.

Adding a Public Stream Export

To add a stream to your account:

  1. nsc add export --name abc --subject "a.b.c.>"
  1. [ OK ] added public stream export "abc"

Note that we have exported stream with a subject that contains a wildcard. Any subject that matches the pattern will be exported.

To review the stream export:

  1. nsc describe account
  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name A
  5. Account ID ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-05 13:35:42 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Imports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭───────────────────────────────────────────────────────────╮
  22. Exports
  23. ├──────┬────────┬─────────┬────────┬─────────────┬──────────┤
  24. Name Type Subject Public Revocations Tracking
  25. ├──────┼────────┼─────────┼────────┼─────────────┼──────────┤
  26. abc Stream a.b.c.> Yes 0 N/A
  27. ╰──────┴────────┴─────────┴────────┴─────────────┴──────────╯

Messages this account publishes on a.b.c.> will be forwarded to all accounts that import this stream.

Importing a Stream

Importing a stream enables you to receive messages that are published by a different Account. To import a Stream, you have to create an Import. To create an Import you need to know:

  • The exporting account’s public key
  • The subject where the stream is published
  • You can map the stream’s subject to a different subject
  • Self-imports are not valid; you can only import streams from other accounts.

With the required information, we can add an import to the public stream.

  1. nsc add account B
  1. [ OK ] generated and stored account key "AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"
  2. [ OK ] added account "B"
  1. nsc add import --src-account ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE --remote-subject "a.b.c.>"
  1. [ OK ] added stream import "a.b.c.>"

Notice that messages published by the remote account will be received on the same subject as they are originally published. Sometimes you would like to prefix messages received from a stream. To add a prefix specify --local-subject. Subscribers in our account can listen to abc.>. For example if --local-subject abc, The message will be received as abc.a.b.c.>.

And verifying it:

  1. nsc describe account
  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name B
  5. Account ID AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-05 13:39:55 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Exports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭─────────────────────────────────────────────────────────────────────────────╮
  22. Imports
  23. ├─────────┬────────┬─────────┬──────────────┬─────────┬──────────────┬────────┤
  24. Name Type Remote Local/Prefix Expires From Account Public
  25. ├─────────┼────────┼─────────┼──────────────┼─────────┼──────────────┼────────┤
  26. a.b.c.> Stream a.b.c.> A Yes
  27. ╰─────────┴────────┴─────────┴──────────────┴─────────┴──────────────┴────────╯

Let’s also add a user to make requests from the service:

  1. nsc add user b
  1. [ OK ] generated and stored user key "UDKNTNEL5YD66U2FZZ2B3WX2PLJFKEFHAPJ3NWJBFF44PT76Y2RAVFVE"
  2. [ OK ] generated user creds file "~/.nkeys/creds/O/B/b.creds"
  3. [ OK ] added user "b" to account "B"

Pushing the changes to the NATS servers

If your NATS servers are configured to use the built-in NATS resolver, remember that you need to ‘push’ any account changes you may have done locally using nsc add to the servers for those changes to take effect.

e.g. nsc push -i or nsc push -a B -u nats://localhost

Testing the Stream

  1. nsc sub --account B --user b "a.b.c.>"

then

  1. nsc pub --account A --user U a.b.c.hello world

Securing Streams

If you want to create a stream that is only accessible to accounts you designate, you can create a private stream. The export will be visible in your account, but subscribing accounts will require an authorization token that must be created by you and generated specifically for the subscribing account.

The authorization token is simply a JWT signed by your account where you authorize the client account to import your export.

Creating a Private Stream Export

  1. nsc add export --subject "private.abc.*" --private --account A

This is sSimilar to when we defined an export, but this time we added the --private flag. The other thing to note is that the subject for the request has a wildcard. This enables the account to map specific subjects to specifically authorized accounts.

  1. nsc describe account A
  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name A
  5. Account ID ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-05 14:24:02 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Imports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭──────────────────────────────────────────────────────────────────────────╮
  22. Exports
  23. ├───────────────┬────────┬───────────────┬────────┬─────────────┬──────────┤
  24. Name Type Subject Public Revocations Tracking
  25. ├───────────────┼────────┼───────────────┼────────┼─────────────┼──────────┤
  26. abc Stream a.b.c.> Yes 0 N/A
  27. private.abc.* Stream private.abc.* No 0 N/A
  28. ╰───────────────┴────────┴───────────────┴────────┴─────────────┴──────────╯

Generating an Activation Token

For a foreign account to import a private stream, you have to generate an activation token. In addition to granting permissions to the account, the activation token also allows you to subset the exported stream’s subject.

To generate a token, you’ll need to know the public key of the account importing the service. We can easily find the public key for account B by running:

  1. nsc list keys --account B
  1. ╭──────────────────────────────────────────────────────────────────────────────────────────╮
  2. Keys
  3. ├────────┬──────────────────────────────────────────────────────────┬─────────────┬────────┤
  4. Entity Key Signing Key Stored
  5. ├────────┼──────────────────────────────────────────────────────────┼─────────────┼────────┤
  6. O OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG *
  7. B AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H *
  8. b UDKNTNEL5YD66U2FZZ2B3WX2PLJFKEFHAPJ3NWJBFF44PT76Y2RAVFVE *
  9. ╰────────┴──────────────────────────────────────────────────────────┴─────────────┴────────╯
  1. nsc generate activation --account A --target-account AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H --subject private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H -o /tmp/activation.jwt
  1. [ OK ] generated "private.abc.*" activation for account "AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"
  2. [ OK ] wrote account description to "/tmp/activation.jwt"

The command took the account that has the export (‘A’), the public key of account B, the subject where the stream will publish to account B.

For completeness, the contents of the JWT file look like this:

  1. cat /tmp/activation.jwt
  1. -----BEGIN NATS ACTIVATION JWT-----
  2. eyJ0eXAiOiJqd3QiLCJhbGciOiJlZDI1NTE5In0.eyJqdGkiOiJIS1FPQU9aQkVKS1JYNFJRUVhXS0xYSVBVTlNOSkRRTkxXUFBTSTQ3NkhCVVNYT0paVFFRIiwiaWF0IjoxNTc1NTU1OTczLCJpc3MiOiJBREVUUFQzNldCSUJVS00zSUJDVk00QTVZVVNEWEZFSlBXNE02R0dWQllDQlc3UlJORlRWNU5HRSIsIm5hbWUiOiJwcml2YXRlLmFiYy5BQU00NkUzWUY1V09aU0U1V05ZV0hOM1lZSVNWWk9TSTZYSFRGMlE2NEVDUFhTRlFaUk9KTVAySCIsInN1YiI6IkFBTTQ2RTNZRjVXT1pTRTVXTllXSE4zWVlJU1ZaT1NJNlhIVEYyUTY0RUNQWFNGUVpST0pNUDJIIiwidHlwZSI6ImFjdGl2YXRpb24iLCJuYXRzIjp7InN1YmplY3QiOiJwcml2YXRlLmFiYy5BQU00NkUzWUY1V09aU0U1V05ZV0hOM1lZSVNWWk9TSTZYSFRGMlE2NEVDUFhTRlFaUk9KTVAySCIsInR5cGUiOiJzdHJlYW0ifX0.yD2HWhRQYUFy5aQ7zNV0YjXzLIMoTKnnsBB_NsZNXP-Qr5fz7nowyz9IhoP7UszkN58m__ovjIaDKI9ml0l9DA
  3. ------END NATS ACTIVATION JWT------

When decoded it looks like this:

  1. nsc describe jwt -f /tmp/activation.jwt
  1. ╭────────────────────────────────────────────────────────────────────────────────────────╮
  2. Activation
  3. ├─────────────────┬──────────────────────────────────────────────────────────────────────┤
  4. Name private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  5. Account ID AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  6. Issuer ID ADETPT36WBIBUKM3IBCVM4A5YUSDXFEJPW4M6GGVBYCBW7RRNFTV5NGE
  7. Issued 2019-12-05 14:26:13 UTC
  8. Expires
  9. ├─────────────────┼──────────────────────────────────────────────────────────────────────┤
  10. Hash ID GWIS5YCSET4EXEOBXVMQKXAR4CLY4IIXFV4MEMRUXPSQ7L4YTZ4Q====
  11. ├─────────────────┼──────────────────────────────────────────────────────────────────────┤
  12. Import Type Stream
  13. Import Subject private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  14. ├─────────────────┼──────────────────────────────────────────────────────────────────────┤
  15. Max Messages Unlimited
  16. Max Msg Payload Unlimited
  17. Network Src Any
  18. Time Any
  19. ╰─────────────────┴──────────────────────────────────────────────────────────────────────╯

The token can be shared directly with the client account.

If you manage many tokens for many accounts, you may want to host activation tokens on a web server and share the URL with the account. The benefit to the hosted approach is that any updates to the token would be available to the importing account whenever their account is updated, provided the URL you host them in is stable.

Importing a Private Stream

Importing a private stream is more natural than a public one as the activation token given to you already has all of the necessary details. Note that the token can be an actual file path or a remote URL.

  1. nsc add import --account B --token /tmp/activation.jwt
  1. [ OK ] added stream import "private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H"

Describe account B

  1. nsc describe account B
  1. ╭──────────────────────────────────────────────────────────────────────────────────────╮
  2. Account Details
  3. ├───────────────────────────┬──────────────────────────────────────────────────────────┤
  4. Name B
  5. Account ID AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H
  6. Issuer ID OAFEEYZSYYVI4FXLRXJTMM32PQEI3RGOWZJT7Y3YFM4HB7ACPE4RTJPG
  7. Issued 2019-12-05 14:29:16 UTC
  8. Expires
  9. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  10. Max Connections Unlimited
  11. Max Leaf Node Connections Unlimited
  12. Max Data Unlimited
  13. Max Exports Unlimited
  14. Max Imports Unlimited
  15. Max Msg Payload Unlimited
  16. Max Subscriptions Unlimited
  17. Exports Allows Wildcards True
  18. ├───────────────────────────┼──────────────────────────────────────────────────────────┤
  19. Exports None
  20. ╰───────────────────────────┴──────────────────────────────────────────────────────────╯
  21. ╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
  22. Imports
  23. ├──────────────────────────────────────────────────────────────────────┬────────┬──────────────────────────────────────────────────────────────────────┬──────────────┬─────────┬──────────────┬────────┤
  24. Name Type Remote Local/Prefix Expires From Account Public
  25. ├──────────────────────────────────────────────────────────────────────┼────────┼──────────────────────────────────────────────────────────────────────┼──────────────┼─────────┼──────────────┼────────┤
  26. a.b.c.> Stream a.b.c.> A Yes
  27. private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H Stream private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H A No
  28. ╰──────────────────────────────────────────────────────────────────────┴────────┴──────────────────────────────────────────────────────────────────────┴──────────────┴─────────┴──────────────┴────────╯

Testing the Private Stream

Testing a private stream is no different than testing a public one:

  1. nsc tools sub --account B --user b private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H

then

  1. nsc tools pub --account A --user U private.abc.AAM46E3YF5WOZSE5WNYWHN3YYISVZOSI6XHTF2Q64ECPXSFQZROJMP2H hello