JWT generation as a Github app

[MayankMadan97]

Hi there!

I'm trying to create a JWT token from a private key generated in a .pem file for a Github app using the JWTS library in java.
Though I can generate the token, it still shows an invalid signature; thus, Github returns 401 as expected.

Sample token : eyJhbGciOiJSUzI1NiJ9.eyJpYXQiOjE2NzgyODg4OTcsImV4cCI6MTY3ODI4OTQ5NywiaXNzIjoiMjkzNjY3In0.a0xnRHblUPX0HbN2a__JFLdAkLT5IE7sfGoZK2BuWi0s-Q-k0KGwK5RUYKnWZuArmQ946bTfjiMz0TM8v_iv78Q7rxM45Cb7rC-iiJ4P7Io25mJ2QuoQ0ASDKJ5wtXh8LZQwCElP7nT2NmtB-Fe2pUfv5uR8W_yk-TqDrVTZTmIIjnrq0lpcS7YSkcPDj__yC3a5BRNcctnX_ot7rCfJcFd5WNy8h5tp_dt6dyzFIk4AwCfeSlClKBU0JE-SiH6UwWWE31Uy6EiAS6HBWlIPk5o3KvJ7cAcWub1kUJmmr8oDKhMjtUcAko1glS9fljYQ8IbuC-08GlSOBcd_C_caXA

public static String generateJwtToken(String appId) {
        LOGGER.debug("generateJwtToken : Entering the method");
        String token = null;
        try {
                // setting bounty castle provider for private key encryption
                java.security.Security.addProvider(
                                new org.bouncycastle.jce.provider.BouncyCastleProvider());
                // reading private key from resources directory
                String rsaPrivateKey = readPrivateKey(Path.of(
                                System.getProperty("user.dir")
                                                + "/coder-gate/src/main/resources/private-key.pem")
                                .toFile());
                // base64 decoding and re-encoding private key using RSA
                PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(
                                Base64.getDecoder().decode(rsaPrivateKey));
                KeyFactory kf = KeyFactory.getInstance("RSA");
                PrivateKey privKey = kf.generatePrivate(keySpec);
                // building jwt token
                token = Jwts.builder()
                                // issued at current timestamp
                                .setIssuedAt(new Date())
                                // expiring in 10 min
                                .setExpiration(new Date(System.currentTimeMillis() + 600000))
                                // issued b y coder gate app
                                .setIssuer(appId)
                                // signed using RS 256 algorithm as reequired by github
                                .signWith(SignatureAlgorithm.RS256, privKey)
                                .compact();
        } catch (IOException | NoSuchAlgorithmException | InvalidKeySpecException e) {
                LOGGER.error("JwtUtils :: generateJwtToken : Failed to generate jwt token {}",
                                Arrays.toString(e.getStackTrace()));
                LOGGER.info("JwtUtils :: generateJwtToken : Setting token as anonymous");
                token = "anonymous";
        }
        LOGGER.debug("generateJwtToken : Exiting the method with token {}", token);
        return token;
}


private static String readPrivateKey(File file) throws IOException {
        return new String(Files.readAllBytes(file.toPath()), Charset.defaultCharset())
                        .replace("-----BEGIN RSA PRIVATE KEY-----", "")
                        .replaceAll(System.lineSeparator(), "")
                        .replace("-----END RSA PRIVATE KEY-----", "");
}

Can someone help me with this?
Thanks in advance :)

[MayankMadan97]

Hi Sayed,
Thanks for the reply.

I was able to fix the problem.

It was not with the way I was reading the file and JWT token generation was fine. I had to do an extra step of passing the generated token to the GitHub installations API for fetching the access token. Which will be used to authenticate with GitHub as an app.

You can follow the below link to see the steps.

https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#generating-an-installation-access-token

[aneelmonangi]

@MayankMadan97 I also got the same error. Fortunately I am not able to view the comments replied from others.
Can you please share me the correct solution for the same use case: generate the JWT and authenticate using the same JWT and generate the installation access token and then using this token to authenticate for API usage

[MayankMadan97]

Hi @aneelmonangi, I resolved the issue by passing the JWT token to the GitHub API to retrieve the actual access token that GitHub provides and requires for API calls.

Follow the below github documentation for the detailed steps:
https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app#generating-an-installation-access-token

[aneelmonangi]

Thanks @MayankMadan97 for the reply.
I mean while generating the JWT I am also getting the same error signature is invalid. I am using the pem file and appId for generating the JWT.
Can you share me the whole code(where I made mistake I can correct) for generating the JWT with valid signature and with proper installation token generation.

Thanks in advance

[MayankMadan97]

I have an open source repository, you can look into where I've implemented OAuth integration with GitHub (Feel free to fork):
https://github.com/MayankMadan97/coder-gate

For specific utility, you can go here:
https://github.com/MayankMadan97/coder-gate/blob/fa01d3d5bbaf6d420258aebb2968b16f5adf8e75/coder-gate/src/main/java/com/github/codergate/utils/JwtUtils.java

[aneelmonangi]

@MayankMadan97 Thanks for the support. I am able to generate the JWT, but still I see the Invalid Signature in the bottom.
I will try to create the installation token with same JWT generated with the code you share and check.

Thanks a lot for the help.

[1brijesh]

I'm still facing same issue, jwt created is of invalid signature , has anyone able to resolve it yet ? I tried using bouncyCastle lib for pkcs#1 format and other way converting .pem to pkcs#8 format but in both the ways the jwt token created is having a Invalid signature . Any help will be appreciated.