Versions Compared

Version Old Version 20 New Version 21
Changes made by

Jeff Slavin (Unlicensed)

Jeff Slavin (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

To authenticate to ClearBlade IoT Core, each device must prepare a JSON Web Token (JWT, RFC 7519). JWTs are used for short-lived authentication between devices and the MQTT or HTTP bridges bridge. This page describes the ClearBlade IoT Core requirements for the JWT’s contents.

...

ClearBlade IoT Core requires these reserved claim fields. They may appear in any order in the claim set.

Name

Description

Required for

iat

Issued at: The timestamp when the token was created, specified as seconds since 00:00:00 UTC, January 1, 1970. The server may report an error if this timestamp is too far in the past or future (allowing 10 minutes for skew).

MQTT, HTTP

exp

Expiration: The timestamp when the token stops being valid, specified as seconds since 00:00:00 UTC, January 1, 1970. The token’s maximum lifetime is 24 hours + skew.

  • The server will close all MQTT connections a few seconds after the token expires (allowing for skew) because MQTT cannot refresh credentials. A new token must be minted to reconnect. Because of the allowed skew, in practice, the token’s minimum lifetime will be equal to the acceptable clock skew, even if set to one second.

  • When connecting over HTTP, each HTTP request must include a JWT, regardless of expiration time.

  • Clients in Network Time Protocol (NTP)-capable devices can use the Google Public NTP Server to keep the device clock synchronized; the requirement for authentication is to keep the clock synchronized with a skew of up to 10 minutes.

MQTT, HTTP

aud

Audience: This must be a single string containing the cloud project ID where the device is registered. The authentication will only be allowed with further analysis if the connection request matches this project ID.

MQTT

sk

System key: This must be a single string containing the ClearBlade registry’s system key. This can be obtained by clicking the API keys button (key icon) at the top-right of the ClearBlade Registry Details page.

HTTP

uid

User ID: This must be a single string containing the deviceId.

HTTP

ut

User type: This must be an integer hard-coded to value 3.

HTTP

The nbf(not before) claim will be ignored and is optional.

...

The JSON Web Signature (JWS) specification guides the mechanics of generating the JWT signature generation mechanics. The signature’s input is this content’s byte array:

...

To compute the signature, sign the base64url-encoded header, base64-url encoded claim set, and a secret key (such as a rsa_private.pem file) using the algorithm you defined in the header. The signature is then base64url-encoded, and the result is resulting in the JWT. This example shows a JWT before base64url encoding:

...