JSON Web Tokens

This topic shows how to authenticate Privacera services using JSON web tokens (JWT).

Supported services:

• Databricks plugin (OLAC/FGAC)
• Open Spark plugin (OLAC/FGAC)
• Dataserver API to generate signature for spark OLAC plugin

Prerequisites

Ensure the following prerequisites are met:

• Get the identity provider URL that is allowed in the issuer claim of a JWT.
• Get the public key from the provider that Privacera services can use to validate JWT.

Configuration

1. SSH to the instance as USER.

2. Copy the public key in ~/privacera/privacera-manager/config/custom-properties folder.

3. Run the following commands.

   cd ~/privacera/privacera-manager
   cp config/sample-vars/vars.jwt-auth.yaml custom-vars
   vi custom-vars/vars.jwt-auth.yaml
   

4. Edit the properties.

   Property	Description	Example
   JWT_OAUTH_ENABLE	Property to enable JWT auth in Privacera services.	TRUE
   JWT_PUBLIC_KEY_FILE_NAME	Enter the name of the file copied in step 2 above.	jwttoken.pub
   JWT_ISSUER	Property to enter the URL of the identity provider.	https://your-idp-domain.com
   JWT_SUBJECT	Subject of the JWT (the user)	api-token
   JWT_SECRET	If the JWT token has been encrypted using secret, use this property to set the secret.	privacera-api
   JWT_USERKEY	Property to define a unique userkey.	client_id
   JWT_GROUPKEY	Property to define a unique group key.	scope
   JWT_PARSER_TYPE	Assign one of the following values: PING_IDENTITY: When scope/group is array KEYCLOAKS: When scope/group is space separator	PING_IDENTITY

5. Run the update.

   cd ~/privacera/privacera-manager/
   ./privacera-manager.sh update
   

JWT for Databricks

Configure

To configure JWT for Databricks, do the following:

1. Enable JWT. To enable JWT, refer Configuration.

2. (Optional) Create a JWT, if you do not have one. Skip this step, if you already have an existing token.

   To create a token, see JWT and use the following details. For more details, refer the JWT docs.

   • Algorithm=RSA256

   • When JWT_PARSER_TYPE is KEYCLOAKS (scope/group is space separator)

     {
     "scope": "jwt:role1 jwt:role2",
     "client_id": "privacera-test-jwt-user",
     "iss": "privacera",
     "exp": <PLEASE_UPDATE>
     }
     

   • When JWT_PARSER_TYPE is PING_IDENTITY (scope/group is array)

     {
     "scope": [
         "jwt:role1",
         "jwt:role1"
     ],
     "client_id": "privacera-test-jwt-user",
     "iss": "privacera",
     "exp": <PLEASE_UPDATE>
     }
     

   • Paste public/private key in input box.

   • Copy the generated JWT Token.

3. Log in to Databricks portal and write the following JWT file in a cluster file. Then the Privacera plugin can read and perform access-control based on the token user.

   %python
   JWT_TOKEN="<PLEASE_UPDATE>"
   TOKEN_LOCAL_FILE="/tmp/ptoken.dat"
   f = open(TOKEN_LOCAL_FILE, "w")
   f.write(JWT_TOKEN)
   f.close()
   

Use Case

Reading files from the cloud using JWT token

1. Read the files in the file explorer of your cloud provider from your notebook. Depending on your cloud provider, enter the location of your cloud files in the <path-to-your-cloud-files>.

   %python
   spark.read.csv("<path-to-your-cloud-files>").show()
   

2. Check the audits. To learn how to check the audits, click here.

   You should get JWT user (privacera-test-jwt-user) which was specified in the payload while creating the JWT.

3. To give permissions on a resource, create a group in Privacera Portal similar to the scope of the JWT payload and give access to the group, It's not necessary to create a user.

   Privacera plugin extracts the JWT payload and passes the group during access check. In other words, it takes user-group mapping from JWT payload itself, so it's not required to do user-group mapping in Privacera.

---

Last update: August 13, 2021