Quarkus MP-JWT: how to generate the key pair? - keytool

Question

I'm trying to work around the RBAC authorization example presented here: https://quarkus.io/guides/security-jwt#generate-jwt-tokens. The code of the GenerateToken class is almost identical to one in the example, I just removed the claims:
public class GenerateToken
{
public static void main(String[] args)
{
String token = Jwt.issuer("CN=me, OU=quarkus, O=quarkus, C=FR").upn("me").groups(new HashSet<>(Arrays.asList("User", "Admin"))).sign();
log.info (">>> GenerateToken.main(): Token is {}", token);
}
}
Now I need to generate the private and public key .pem files. I wrote the following script:
keytool -genkey -keyalg RSA -keystore ./jks/selfsigned.jks -keysize 2048 -dname "CN=me,OU=quarkus,O=quarkus,C=FR"
keytool -exportcert -keystore ./jks/selfsigned.jks -rfc -file src/main/resources/META-INF/resources/public-key.pem
keytool -importkeystore -srckeystore ./jks/selfsigned.jks -destkeystore ./jks/selfsigned.p12 -srcstoretype jks -deststoretype pkcs12
openssl pkcs12 -in ./jks/selfsigned.p12 -nodes -nocerts -out src/test/resources/private-key.pem
The private-key.pem and public-key.pem files are generated correctly as far as I can tell. But running the GenerateToken class raises the exception below:
mvn exec:java -Dexec.classpathScope=test -Dsmallrye.jwt.sign.key-location=private-key.pem
[INFO] Scanning for projects...
...
[INFO] --- exec-maven-plugin:1.6.0:java (default-cli) # eclipse-microprofile ---
[WARNING]
java.lang.NullPointerException
at io.smallrye.jwt.build.impl.JwtSignatureImpl.keyAlgorithm (JwtSignatureImpl.java:186)
at io.smallrye.jwt.build.impl.JwtSignatureImpl.signInternal (JwtSignatureImpl.java:150)
at io.smallrye.jwt.build.impl.JwtSignatureImpl.sign (JwtSignatureImpl.java:72)
at ... GenerateToken.main (GenerateToken.java:14)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:566)
at org.codehaus.mojo.exec.ExecJavaMojo$1.run (ExecJavaMojo.java:282)
at java.lang.Thread.run (Thread.java:834)
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.572 s
[INFO] Finished at: 2020-09-19T18:10:50+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.codehaus.mojo:exec-maven-plugin:1.6.0:java (default-cli) on project eclipse-microprofile: An exception occured while executing the Java class. null: NullPointerException -> [Help 1]
Running the original example, with the provided publicKey.pem and privateKey.pem, works as expected of course. What am I doing wrong here ?
Many thanks in advance.
Seymour GLASS

Answer 1

I'm answering my own question. The keytool doesn't seem to work for some reason with MP-JWT but openssl does. Hence, instead of the script above, the following command will work as expected:
openssl req -x509 -newkey rsa:2048 -nodes -keyout src/test/resources/private-key.pem -out src/main/resources/META-INF/resources/public-key.pem -days 365 -subj "/C=FR/O=quarkus/CN=me"
This will create a new self-signed certificate and extract its public key in the file src/main/resources/META-INF/resources/public-key.pem and the private one in src/test/resources/private-key.pem. Now, running mvn exec:java will work:
mvn exec:java -Dexec.mainClass=org.acme.security.jwt.GenerateToken -Dexec.classpathScope=test -Dsmallrye.jwt.sign.key-location=private-key.pem
[INFO] Scanning for projects...
[INFO]
[INFO] ----< fr.simplex-software.aws.lambda.quarkus:eclipse-microprofile >-----
[INFO] Building eclipse-microprofile 1.0-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- exec-maven-plugin:1.6.0:java (default-cli) # eclipse-microprofile ---
sept. 21, 2020 5:10:24 PM fr.simplex_software.aws.lambda.quarkus.GenerateToken main
INFO: >>> GenerateToken.main(): Token is eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJDTj1uZHVtaW5pbCwgTz1TaW1wbGV4U29mdHdhcmUsIEM9RlIiLCJ1cG4iOiJuZHVtaW5pbCIsImdyb3VwcyI6WyJVc2VyIiwiQWRtaW4iXSwiaWF0IjoxNjAwNzAxMDIzLCJleHAiOjE2MDA3MDEzMjMsImp0aSI6Ik91U0kzM19PSVVYbkJCLWpkTjZyUmcifQ.L1RbrJ89nbaE2_xfiDaaVZ5Y00n8U3W5SFUhuwb6sgFaSXExFhziPYjhsqTZO5Rv0DRiz48GkmveP70c5EShS4gNuq8fw1ifvzUF4001oY4Pkgs-ZDZyTmjgWr9GElVr0nOGBhFE9qLMbCF9YcJt-dUgq0JzK93gj3BKi9wWpzFSPRdIZn9f6Xs-FPL7TyNwoHYEm4UYHY5AdxE4lsw0BbGCIgUUKZEO8iFsuOiEUvgosYiIwGdPC-16kOC-xINq2ObzPdHOZixEZGh9xb3tYFALxfxKX8UznckiMbXwc36qQ6WorJA1mPPuyMCKjE310rZzSx9fDiaO0-wGDAkq0A
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.768 s
[INFO] Finished at: 2020-09-21T17:10:24+02:00
[INFO] ------------------------------------------------------------------------