lib: app_jwt: add an application core jwt generator and add a sample for usage #19561

ayla-nordicsemi · 2024-12-16T13:58:07Z

Add a JWT generator in lib directory and add a sample application to demonstrate the usage.

@tokangas : the jwt generator interface API is defined here "include/user_app_jwt.h", your feedback on this interface is welcome !

NordicBuilder · 2024-12-16T14:01:36Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 42

Inputs:

Sources:

more details

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (0)

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

❌ Toolchain
❌ Build twister
❌ Integration tests

Note: This message is automatically posted and updated by the CI

samples/jwt/Kconfig

samples/jwt/sample.yaml

samples/jwt/prj.conf

tokangas

The commit message needs some work. If the name of the library is user_app_jwt, the title should start with lib: user_app_jwt:. There should be empty lines after the title and before the signature. Add also a description for the commit, in addition to the Jira item, which is internal.

I did not go through the whole PR yet, will continue later.

CODEOWNERS

include/user_app_jwt.h

lib/user_app_jwt/user_app_jwt.c

samples/jwt/boards/nrf9280pdk_nrf9280_cpurad.conf

lib/user_app_jwt/user_app_jwt.c

lib/app_jwt/app_jwt.c

include/app_jwt.h

samples/jwt/CMakeLists.txt

NordicBuilder · 2025-02-12T14:49:52Z

You can find the documentation preview for this PR at this link.

Note: This comment is automatically posted by the Documentation Publish GitHub Action.

parttimaa · 2025-02-17T07:45:19Z

samples/jwt/src/main.c

+		LOG_INF("JWT(%d) : %s", strlen(jwt_str), jwt_str);
+	} else {
+		LOG_ERR("jwt_generate error : %d", ret);
+	};


Editorial: Extra semicolon (;) at the end of this line.

nordicjm

apply comments throughout whole PR

nordicjm · 2025-02-17T13:47:02Z

include/app_jwt.h

+	JWT_KEY_TYPE_ENDORSEMENT = 8,
+};
+
+/**@brief JWT signing algorithm */


differs from other help text with space before brief

nordicjm · 2025-02-17T13:48:14Z

include/app_jwt.h

+	/** Defines how long the JWT will be valid; in seconds (from generation).
+	 * The 'iat' and 'exp' claims will be populated either the application
+	 * has or not a valid date and time.
+	 */


usually has the form:

/** * First line of comment */

and top/bottom lines are delimiters only to prevent jagged text indent (for information only)

nordicjm · 2025-02-17T13:49:52Z

include/app_jwt.h

+ *
+ * The API doesn't verify the time source validity, it is up to the caller to make sure
+ * that the system has access to a valid time source, otherwise "iat" field will
+ * containt the time since boot in seconds.


nordicjm · 2025-02-17T13:50:23Z

include/app_jwt.h

+ * @retval 0 If the operation was successful.
+ *         Otherwise, a (negative) error code is returned, check header errno.h for a full list.


2 @retvals one per line, apply comments throughout

do you mean it should be like this :

Suggested change

* @retval 0 If the operation was successful.

* Otherwise, a (negative) error code is returned, check header errno.h for a full list.

* @retval 0 If the operation was successful.

* @retval a (negative) error code is returned, check header errno.h for a full list.

* @retval -errno Negative errno for other failures.

nordicjm · 2025-02-17T13:51:12Z

lib/app_jwt/Kconfig

+	# needed for time and date
+	select POSIX_API
+	# needed to print integer values in JSON


comments start with capital letters

nordicjm · 2025-02-17T13:52:42Z

lib/app_jwt/app_jwt.c

+
+/* Length of JTI field, this should be at least UUIDv4 size
+ * + size of board name
+ **/


nordicjm · 2025-02-17T13:53:05Z

lib/app_jwt/app_jwt.c

+		return -EINVAL;
+	}
+	/* this will hold 4 integer words in string format */
+	/*(string Length 8 + 1) */


space after /*

nordicjm · 2025-02-17T13:53:58Z

samples/jwt/Kconfig

+	bool "Json Web Token Sample"
+	select APP_JWT
+	help
+	   "Enable sample-specific configurations."


why are there quotes in help text

nordicjm · 2025-02-17T13:54:20Z

samples/jwt/Kconfig

+menuconfig JWT_SAMPLE
+	bool "Json Web Token Sample"
+	select APP_JWT
+	help


why is this even in a Kconfig? Put it in prj.conf ?

nordicjm · 2025-02-17T13:55:07Z

samples/jwt/README.rst

+JWT signing verification
+========================
+
+Flag CONFIG_APP_JWT_VERIFY_SIGNATURE allow to verify the JWT signature against the IAK key.


use proper

:kconfig:option:`CONFIG_x`

syntax

divipillai · 2025-02-17T13:17:00Z

doc/nrf/libraries/app_jwt/index.rst

@@ -0,0 +1,11 @@
+.. _lib_app_jwt:
+
+Library Application JWT


Since Application JWT is a single library, it would be better to placed under the "nrf\doc\nrf\libraries\others" folder.

divipillai · 2025-02-17T13:20:11Z

doc/nrf/libraries/app_jwt/app_jwt.rst

@@ -0,0 +1,80 @@
+.. _app_jwt:


Suggested change

.. _app_jwt:

.. _lib_app_jwt:

As per the guideline here: https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/templates/library_template_README.html

divipillai · 2025-02-17T13:21:30Z

doc/nrf/libraries/app_jwt/app_jwt.rst

+Application JWT
+###################


Suggested change

Application JWT

###################

Application JWT

###############

divipillai · 2025-02-17T13:34:16Z

doc/nrf/libraries/app_jwt/app_jwt.rst

+Application JWT
+###################
+
+The Application JWT library provides access to the `JSON Web Token (JWT)`_ generation feature from application core using signing and identity services from secure core.


Suggested change

The Application JWT library provides access to the `JSON Web Token (JWT)`_ generation feature from application core using signing and identity services from secure core.

The Application JWT library provides access to the `JSON Web Token (JWT)`_ generation feature from application core using signing services and secure core using identity services.

Signing is done by Secure core,
Identification (generation of the UUID) is also done by secure core.

maybe rephrasing to the following to avoid any ambiguities :

Suggested change

The Application JWT library provides access to the `JSON Web Token (JWT)`_ generation feature from application core using signing and identity services from secure core.

The Application JWT library provides access to the `JSON Web Token (JWT)`_ generation feature from Application core using Secure core signing service and identity service.

divipillai · 2025-02-17T14:18:04Z

doc/nrf/libraries/app_jwt/app_jwt.rst

+   * :Kconfig:option:`CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED`
+   * :Kconfig:option:`CONFIG_SSF_DEVICE_INFO_SERVICE_ENABLED`
+
+#. Read the device UUID (:c:func:`app_jwt_get_uuid`)


Suggested change

#. Read the device UUID (:c:func:`app_jwt_get_uuid`)

#. Read the device UUID (:c:func:`app_jwt_get_uuid`).

divipillai · 2025-02-17T14:57:03Z

doc/nrf/libraries/app_jwt/app_jwt.rst

+* :c:member:`app_jwt_data.jwt_buf` - Required.
+  Buffer for the generated, null-terminated, JWT string.
+  Buffer size has to be al least 600 bytes, at most 900 bytes.
+  The user has to provide a valid buffer, library doesn't do any allocation.


Suggested change

The user has to provide a valid buffer, library doesn't do any allocation.

You must to provide a valid buffer, library does not do any allocation.

divipillai · 2025-02-17T15:07:45Z

doc/nrf/libraries/app_jwt/app_jwt.rst

+
+Application JWT
+###################
+


.. contents::
:local:
:depth: 2

divipillai · 2025-02-17T15:09:53Z

samples/jwt/README.rst

+jwt generator
+###################


Suggested change

jwt generator

###################

JWT generator

#############

divipillai · 2025-02-17T15:12:00Z

samples/jwt/README.rst

+   :local:
+   :depth: 2
+
+This sample shows how Application core can generate a JWT signed with the IAK.


Suggested change

This sample shows how Application core can generate a JWT signed with the IAK.

This sample shows how application core can generate a JWT signed with the IAK.

divipillai · 2025-02-17T15:26:03Z

samples/jwt/README.rst

+
+   * - Board
+     - Support
+   * - nrf9280pdk/nrf9280/cpuapp


Not sure whether the nRF9280 PDK should be mentioned in the public docs now? Please check this with the PMT.
Hence, sample doc is not completely reviewed.

Also, the table should be pulled from the sample.yml file - https://raw.githubusercontent.com/nrfconnect/sdk-nrf/refs/heads/main/doc/nrf/templates/sample_README.rst.

Hi Divya,
nrf9280pdk is already public : https://docs.nordicsemi.com/bundle/ncs-2.7.99-cs2/page/zephyr/boards/nordic/nrf9280pdk/doc/index.html

pascal-nordic · 2025-02-07T11:24:52Z

samples/jwt/src/main.c

+
+#include <zephyr/kernel.h>
+#include <zephyr/logging/log.h>
+LOG_MODULE_REGISTER(jwt_sample, CONFIG_JWT_SAMPLE_LOG_LEVEL);


Missing extra enter on top LOG_MODULE_REGISTER...

pascal-nordic · 2025-02-17T08:55:36Z

lib/app_jwt/app_jwt.c

Are you planning to address the unite test for this in a separate PR?

pascal-nordic · 2025-02-17T09:08:06Z

lib/app_jwt/app_jwt.c

+static char *jwt_payload_create(const char *const sub, const char *const aud, uint64_t exp)
+{
+	int err = 0;
+


You don't need to have a space between all these declarations

github-actions · 2025-02-20T10:50:13Z

After documentation is built, you will find the preview for this PR here.

Preview links for modified nRF Connect SDK documents:

https://ncsdoc.z6.web.core.windows.net/PR-19561/nrf/libraries/app_jwt/app_jwt.html
https://ncsdoc.z6.web.core.windows.net/PR-19561/nrf/libraries/app_jwt/index.html
https://ncsdoc.z6.web.core.windows.net/PR-19561/nrf/samples/jwt/README.html

Ref: NRFX-6688 Signed-off-by: Aymen LAOUINI <aymen.laouini@nordicsemi.no>

sonarqubecloud · 2025-02-24T15:36:33Z

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

ayla-nordicsemi requested review from tokangas, mwinblad-n, parttimaa and mparpala December 16, 2024 13:58

ayla-nordicsemi self-assigned this Dec 16, 2024

github-actions bot added the changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. label Dec 16, 2024

ayla-nordicsemi force-pushed the add_jwt_generation_for_user_application branch from ebc5af3 to 4b8344f Compare December 16, 2024 15:00

github-actions bot added doc-required PR must not be merged without tech writer approval. and removed changelog-entry-required Update changelog before merge. Remove label if entry is not needed or already added. labels Dec 16, 2024