# JWT Proxy recommendations

**URL:** <https://forum.canton.network/t/jwt-proxy-recommendations/2448>\
**Category:** App Development\
**Created:** [April 13, 2021, 8:22pm UTC](https://forum.canton.network/t/jwt-proxy-recommendations/2448 "2021-04-13T20:22:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![perbergman](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/perbergman/32/1804_2.png) [@perbergman](https://forum.canton.network/u/perbergman)\
**Post date:** [April 13, 2021, 8:22pm UTC](https://forum.canton.network/t/jwt-proxy-recommendations/2448/1 "2021-04-13T20:22:05Z")

</div>

Is there a recommended JWT Proxy out there?

We cannot change the customer’s oauth2 provider and need to inject claims as well as support m2m token refresh. Seems like a JWT Proxy/reverse proxy makes sense, but I can be wrong.

And how does the new auth middleware fit here?

Per

---

<div class="post-metadata">

**Author:** ![cocreature](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/cocreature/32/36_2.png) [@cocreature](https://forum.canton.network/u/cocreature)\
**Post date:** [April 14, 2021, 7:20am UTC](https://forum.canton.network/t/jwt-proxy-recommendations/2448/2 "2021-04-14T07:20:01Z")

</div>

The new auth middleware tries to bridge between an auth provider that provides tokens that are already in the format expected by the ledger (meaning atm the JWTs you’re used to with the corresponding claims) and components like the trigger service which should not be tied to a specific auth provider. It does not bridge the gap between an auth provider that provides different tokens and the ledger which expects a different token format.

I don’t have any personal experience here but let me ask around and get back to you.

---

<div class="post-metadata">

**Author:** ![Tamas\_Kalcza](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/tamas_kalcza/32/1788_2.png) [@Tamas\_Kalcza](https://forum.canton.network/u/Tamas_Kalcza)\
**Post date:** [April 14, 2021, 8:01am UTC](https://forum.canton.network/t/jwt-proxy-recommendations/2448/3 "2021-04-14T08:01:10Z")

</div>

Do you mean AuthProvider\_A issues a token like:

```json
{
  "administrator": true,
  "application": "foobar",
  "user": "Alice",
  "services": [
    "MyLedger"
  ]
}

```

and we would have a bridge which would to turn this into:

```json
{
  "https://daml.com/ledger-api": {
    "ledgerId": "MyLedger",
    "applicationId": "foobar",
    "actAs": ["Alice"],
    "admin": true
  }
}

```

---

<div class="post-metadata">

**Author:** ![perbergman](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/perbergman/32/1804_2.png) [@perbergman](https://forum.canton.network/u/perbergman)\
**Post date:** [April 14, 2021, 1:34pm UTC](https://forum.canton.network/t/jwt-proxy-recommendations/2448/4 "2021-04-14T13:34:08Z")

</div>

Exactly.

I found this one [GitHub - eclipse/che-jwtproxy](https://github.com/eclipse/che-jwtproxy).  
And some of the code in [GitHub - digital-asset/ex-secure-daml-infra: Reference example of a secure Ledger deployment using mTLS and JWT tokens](https://github.com/digital-asset/ex-secure-daml-infra) might do some of this too.

---

<div class="post-metadata">

**Author:** ![nycnewman](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/nycnewman/32/15_2.png) [@nycnewman](https://forum.canton.network/u/nycnewman)\
**Post date:** [April 14, 2021, 5:40pm UTC](https://forum.canton.network/t/jwt-proxy-recommendations/2448/5 "2021-04-14T17:40:37Z")

</div>

I am the author of the ref app (ex-secure-daml-infra). It doesn’t specifically address this (the translation of claims). It might be possible to use a service like Auth0 to do this for you but I have not looked into this. Effectively the proxy also needs to be a JWT signer itself as the ledger would be configured to trust the proxy and the proxy the original source of tokens.

Auth0 and others, might allow you to map authenticate from source into Auth0 including claims and then use Rules to map claim to new format.

---

<div class="post-metadata">

**Author:** ![perbergman](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/perbergman/32/1804_2.png) [@perbergman](https://forum.canton.network/u/perbergman)\
**Post date:** [April 14, 2021, 6:12pm UTC](https://forum.canton.network/t/jwt-proxy-recommendations/2448/6 "2021-04-14T18:12:56Z")

</div>

Yes, auth0 is a no-brainer, we cannot modify the initial token provider, we need to modify in-flight.  
Going to try with [GitHub - eclipse/che-jwtproxy](https://github.com/eclipse/che-jwtproxy).