Versions Compared

Version Old Version 11 New Version 12
Changes made by

Jeff Slavin (Unlicensed)

Jeff Slavin (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

ClearBlade IoT Core does not require a specific token generation method. Helper client libraries can be found on JWT.io.

When creating an MQTT client, the The JWT must be passed in the CONNECT message’s password field . When connecting over HTTP, a when creating an MQTT client. A JWT must be included in each HTTP request’s header when connecting over HTTP.

Creating JWTs

JWTs have three sections: a header, payload (containing a claim set), and signature. The header and payload are JSON objects, serialized to UTF-8 bytes, then encoded using base64url encoding. Note that ClearBlade has strict JWT base64url encoding requirements, unlike Google.

...

Name

Description

iat

("Issued At"): The timestamp when the token was created, specified as seconds since 00:00:00 UTC, January 1, 1970. The server may report an error if this timestamp is too far in the past or future (allowing 10 minutes for skew).

exp

("Expiration"): The timestamp when the token stops being valid, specified as seconds since 00:00:00 UTC, January 1, 1970. The token’s maximum lifetime is 24 hours + skew.

  • The server will close all MQTT connections a few seconds after the token expires (allowing for skew) because MQTT does not have a way to refresh credentials. A new token must be minted to reconnect. Because of the allowed skew, in practice, the token’s minimum lifetime will be equal to the acceptable clock skew, even if it is set to one second.

  • When connecting over HTTP, each HTTP request must include a JWT, regardless of expiration time.

  • Clients in Network Time Protocol (NTP)-capable devices can use the Google Public NTP Server to keep the device clock synchronized; the requirement for authentication is to keep the clock synchronized with a skew of up to 10 minutes.

aud

("Audience"): This must be a single string containing the cloud project ID where the device is registered. If The authentication will only be allowed with further analysis if the connection request does not match matches this project ID, the authentication will be denied without further analysis.

The nbf("Not Before") claim will be ignored and is not required.

...