Table of Contents
List of Examples
leeway_sec parameterjwt3_generate usagejwt3_verify usagejwt3_verify_key usage$jwt3(name) usageTable of Contents
This module provides JWT (JSON Web Token) functions to be used in Kamailio configuration file.
It relies on libjwt (at least v3.2.0) library (https://github.com/benmcollins/libjwt).
This parameter defines the time tolerance in seconds used to account for clock skew when validating the exp (expiration) and nbf (not before) claims. A value of -1 disables nbf/exp claim validation, while any positive integer sets the allowable leeway window.
Default value is -1.
Generate the JWT, its value can be retrieved in the variable $jwt3(val).
The parameters are:
prvkey - path to private key (PEM or JWKS)
alg - the algorithm to build the signature, as supported by the libjwt (e.g., RS256, HS256, ES256, ...)
claims - the list of claims to be added to JWT, in the format "name1=value1;name2=value2;..." (same as the SIP parameters format). The string values can be enclosed in single or double quotes. If a value is not eclosed in between quotes, it is added as numeric value if it is successfully converted to a long value, otherwise is added as string value.
headers - the list of headers to be added to JWT, in the format "name1=value1;name2=value2;..." (same as the SIP parameters format). The string values can be enclosed in single or double quotes. If a value is not eclosed in between quotes, it is added as numeric value if it is successfully converted to a long value, otherwise is added as string value. If prvkey points to a JWKS (JSON Web Key Set), you can pass "kid=...;" in the header parameter to select a specific key for signing. If no kid is specified, the first key in the set will be used by default.
This function can be used from ANY_ROUTE.
Example 1.2. jwt3_generate usage
...
jwt3_generate("/path/to/prvkey.json", "ES256",
"caller='$fU';callee='$tU';callid='$ci';index=100");
...
Verify the JWT.
The parameters are:
pubkeypath - path to public key file (PEM or JWKS)
alg - the algorithm to build the signature, as supported by the libjwt (e.g., RS256, HS256, ES256, ...)
claims - the list of claims to be checked they are in the JWT, in the format "name1=value1;name2=value2;..." (same as the SIP parameters format, see also the description of claims parameter for jwt3_generate()).
jwtval - the value of the JWT to verify. If pubkeypath points to a JWKS, and the incoming JWT header contains a kid, the key with the matching identifier will be used for verification. If no kid is present, the first key in the set is used by default.
This function can be used from ANY_ROUTE.
Example 1.3. jwt3_verify usage
...
if(!jwt3_verify("/path/to/pubkey.json", "ES256",
"caller='$fU';callee='$tU';callid='$ci';index=100",
"$var(jwt)") {
xwarn("failed to verify jwt\n");
}
...
Verify the JWT.
The parameters are:
pubkeyval - public key value
alg - the algorithm to build the signature, as supported by the libjwt (e.g., RS256, HS256, ES256, ...)
claims - the list of claims to be checked they are in the JWT, in the format "name1=value1;name2=value2;..." (same as the SIP parameters format, see also the description of claims parameter for jwt3_generate()).
jwtval - the value of the JWT to verify
This function can be used from ANY_ROUTE.
Example 1.4. jwt3_verify_key usage
...
if(!jwt3_verify_key("...", "RS256",
"caller='$fU';callee='$tU';callid='$ci';index=100",
"$var(jwt)") {
xwarn("failed to verify jwt\n");
}
...
Get the values and attributes after using JWT functions.
The key can be:
val - the value of JWT after a successful jwt3_generate().
status - the status of verification after a failed jwt3_verify().
Example 1.5. $jwt3(name) usage
...
jwt3_generate("/path/to/prvkey.pem", "RS256",
"caller='$fU';callee='$tU';callid='$ci';index=100");
xinfo("jwt is: $jwt3(val)");
...