TOKEN SERVER

 Authentication is an everyday necessity in our applications, and tokens are widely used nowadays. In this article, I developed one app for login to users in two ways; the first was by email and password, and the second by token; I hope this project could be helpful for someone that will start with the topic of JWT tokens.

Prerequisites

• Spring Boot: this is the java framework used to develop the app.
• Jose 4j: This is the library to create and validate the JWT token; the project doesn't use Spring Security to manage tokens. 
• Openssl: is a utility in Linux OS to generate "key pairs"; it's useful when using JWT tokens. 
• ByCrypt: is a one-way algorithm to protect data; it was used to protect the user's password, the app doesn't use Spring Security for that, and it can use another algorithm like a Pbkdf2Sha1.

• Clean Architecture:  the project follows the pieces of advice that Martin Fowler gives in the book "Clean Architecture.". 

Use Cases

The project work with three use cases.

1. Register User: the user has to register in the app before validating in the app.

2. Login by email and password: the user has to use your email and password to authenticate their identity.

3. Login by token: the user could use one token with data to authenticate their identity 

 

Architecture  

The project is a monolith; it tries to use the principle of screaming architecture; therefore, it is split into two layers. 

•  Domain layer: in this layer, the application has the use cases and the entities; the domain represents the business core for the application. The dependency inversion principle (DIP) is used to develop the use cases; all of them in the constructor receive interfaces; therefore, the implementations are hidden from the business logic.
• Infrastructure layer: this layer has adapters, controllers, and other kinds of specific implementation for the interfaces (gateways).

Packaging (Ports and adapters) 

This is the packaging structure for the project.

 

• The services for creating and validating tokens were implemented in the helper package; likewise, the encryption service was implemented in the same package. Finally, the gateway package has the primary interfaces to the app.
  
  
• To configure some features for the Spring Boot app, you have to use other folders like configurations or exceptions, but this kind of data is outside the package model to port and adapters.

Create key pairs

To firm the token, you need two pairs of keys. The first is a private key, and the other is a public key; a common tool to generate these keys of files is Openssl; the steps to generate this file are:

1.  Generate a private key with this command  

     “openssl genrsa -out privatekey.pem 2048”

2. To work with java is necessary to convert this key to “PKCS#8”  so to cast this format use this command.

    “openssl pkcs8 -in privatekey.pem -topk8 -nocrypt -out privatekey-pkcs8.pem”

3. To generate the public key, you have to use this command.

     “openssl rsa -in privatekey.pem -out publickey.pem –pubout”

 In the end, you will have three files; the information of these files (privatekey-pkcs8.pem, publickey.pem) was copied into the class “KeyFactoryToken.java” if you want more information about this; you can check this post.

Deploy app 

You can run this app in two ways; the first how a common Spring Boot App, and the second is to build a Docker image with the command “docker-compose up –d”.

After the project works, you can use the Postman collection and follow the following steps.

 1. Call the endpoint to create a user 

The answer includes a token; please copy the token information; it will be helpful in the next step.

• If you want to check the data saved by the app, you can check it; you have to open the web browser and copy this URL "http://localhost:8080/h2/"; the password is “123456”.

When you build the query “SELECT * FROM users;” the response shows the password encrypted.

2. Use the URL endpoint to validate the token; copy the Token in the field "token"; after that, you can prove the URL endpoint; The response will have the same information as the client when you created and registered him; therefore, you have a login successful with token details.

This is the Git repository for the project; you have to use the Postman collection to test the app (check it in the repo); in the next post, you will see how to use a frontend app that uses this backend app bye.