JWT 401 unauthorized

LorisLombardo87

Hi all,

i'm trying to login to qlik using a JWT token but when i try to post to https://horsadev.eu.qlikcloud.com/login/jwt-session with the the web integration id and the bearer token i get the following error.

the token is made up like this:

user details: name sub and email are the exactly like the console.

any idea of what can go wrong here?

thanks,

Loris

mpc

Hi,

Can you check if the token isn't expired yet ?

Kind regard

LorisLombardo87

thanks for the suggestion Mpc

the token is created with jsonwebtoken I've tried various configurations of expiresIn from 30s to 60m and it is anyway consumed just after its creation, always the same result unfortunately.

Loris

mpc

Ok, I assume you've followed this guide: https://community.qlik.com/t5/Member-Articles/Enhanced-Guide-Embedding-Qlik-Cloud-Content-with-JWT/t...

LorisLombardo87

no i haven't, there are so many qlik guides on this topic on line 😅...

the interesting bits on that guide though is the mention of the sub field, I've used the one that I can get clicking on the i icon in the users list.

is it the same as the one I can get with https://yourcloudtenant/api/v1/users/me ?

in general what should this sub field (claim) be?

mpc

You should use the one provided by the URL its return. It's not the one you cand find on the (i) icon in the QMC.
Moreover, in the final script, you will use ttps://yourcloudtenant/api/v1/users/me to affect the right sub to the user who attempt to log in.

LorisLombardo87

just to be 100% clear shall I use the one highlighted in red here ?

mpc

Yes, it's not the good one, you shoud use the Qlik one beggining by 6 in your screnshot

LorisLombardo87

I think the issue might be somewhere else, the error message doesn't change if I add one or the other.

if i look at that guide i cannot see any other suspect element...

any other suggestion ?

alex_colombo

Hey @LorisLombardo87 , token seems to be correct. I'm sharing how I create it with jsonwebtoken.

Can you post your JWT IdP configuration set in Management Console and you HTTP request?

const private_key = fs.readFileSync("./key/privatekey.pem", "utf8");

const tenantHost = 'saas.qlikcloud.com';

const id = {
    email: `email@qlik.com`,
    name: "Alex Colombo",
    sub: `idp_subject`
};

const signingOptions = {
    keyid: "keyId",
    algorithm: "RS256",
    issuer: "saas.qlikcloud.com",
    expiresIn: "1m",
    notBefore: "0s",
    audience: "qlik.api/login/jwt-session",
};

const payload = {
    jti: crypto.randomBytes(16).toString("hex"),
    sub: id.sub,
    subType: "user",
    email_verified: true,
    email: id.email,
    name: id.name,
    groups: id.groups,
};

const token = jsonwebtoken.sign(payload, private_key, signingOptions);

console.log(token);

setTimeout(async () => {
    const resp = await fetch(`https://${tenantHost}/login/jwt-session`, {
        method: "POST",
        headers: {
        Authorization: `Bearer ${token}`,
        },
    });
    const resp2 = await fetch(`https://${tenantHost}/api/v1/items?resourceType=app`, {
        headers: {
        Authorization: `Bearer ${token}`,
        },
    });

    console.log('resp status: ', resp2.status)
}, 200)

API

Integration

SaaS