Onboarding a new participant and using audience based JWT for user management

Questions
,
1

The audience based JWT tokens require the audience to be https://daml.com/jwt/aud/participant/someParticipantId, however the participant id is known only after the participant node is brought up. For instance, if I have a config like

participants {
   hooli {
     ....
   }
}

I initially assumed that hooli is the participant id and set up my identity provider to give this audience to tokens: https://daml.com/jwt/aud/participant/hooli. However, canton expects the full participant id that has some hash in the end.

I am confused on how to configure my identity provider, since I don’t know the participant id until it is brought up. I am thinking that I will have to dynamically set up the identity provider after the participant joins. Can someone help me figure this out?

2

You’re completely right that it is difficult to setup authorization for that. That’s why Daml 2.6.1 added a new feature where you can instead configure the audience that the participant validates your token against.

The configuration looks something like this

canton {
  participants {
    participant {
      ledger-api {
        auth-services = [{
          type = jwt-rs-256-jwks
          url = "https://example.com/.well-known/jwks.json"
          target-audience = "https://example.com"
        }]
      }
    }
  }
}
2 Likes