From f7f3093275641b9fc692cf89534d7892a50b54cf Mon Sep 17 00:00:00 2001 From: Nathan Totten Date: Tue, 14 Nov 2023 15:27:19 -0500 Subject: [PATCH] updated clerk policy --- policies/clerk-jwt-auth-inbound/doc.md | 117 ------------------------- 1 file changed, 117 deletions(-) delete mode 100644 policies/clerk-jwt-auth-inbound/doc.md diff --git a/policies/clerk-jwt-auth-inbound/doc.md b/policies/clerk-jwt-auth-inbound/doc.md deleted file mode 100644 index be366f81..00000000 --- a/policies/clerk-jwt-auth-inbound/doc.md +++ /dev/null @@ -1,117 +0,0 @@ -## Using the Policy - -Adding Auth0 to your route takes just a few steps, but before you can add the -policy you'll need to have Auth0 setup for API Authentication. - -### Setup Auth0 - -To use Auth0 as an API authentication provider, you'll need to create both an -Application and an API in the Auth0 dashboard. The steps below cover the basics, -but if you need more details see the Auth0 links throughout this document. - -1. Create the Auth0 API - ([Auth0 Doc](https://auth0.com/docs/get-started/auth0-overview/set-up-apis)) - - In the Auth0 dashboard, select **APIs** on the sidebar, then click the **+ - Create API** button. - - Enter the **Name** and **Identifier** of your application. The identifier is - usually a URI such as `https://api.example.com/`. The URL used in the - identifier does NOT have to be the URL of your actual API. A common practice - is to use the URL of your production API. Save this value, you'll use it in - the next section. - -2. Get the Auth0 Domain - - On your newly created Auth0 API, click the **Test** tab. This tabs shows how - to create a - [Machine-to-Machine](https://auth0.com/docs/get-started/authentication-and-authorization-flow/call-your-api-using-the-client-credentials-flow) - access token from a test application that Auth0 automatically created for - your API. - - From the first code block on this page, find the URL value as shown below. - Copy the **hostname** portion (outlined in red) of this URL (not the - `https://` or the trailing `/oauth/token` parts). For example - `your-account.us.auth0.com`. Save this value, you'll use it in the next - section. - - - -3. Get an Access Token - - Find the code block that contains the `access_token` and copy the **entire** - token value (without the quotes) and save it. You'll use this later to test - your Auth0 JWT policy in Zuplo. - - - -### Set Environment Variables - -Before adding the policy, there are a few environment variables that will need -to be set that will be used in the Auth0 JWT Policy. - -:::caution - -It is very important in the next steps that the values match **EXACTLY** as they -are found in Auth0. - -::: - -1. In the [Zuplo Portal](https://portal.zuplo.com) open the **Environment - Variables** section in the **Settings** tab. - -2. Click **Add new Variable** and enter the name `AUTH0_DOMAIN` in the name - field. Set the value to - -3. Click **Add new Variable** again and enter the name `AUTH0_AUDIENCE` in the - name field. Set the value to the **identifier** URI you used when creating - the Auth0 API in the section above (i.e. `https://api.example.com/`). - -### Add the Auth0 Policy - -The next step is to add the Auth0 JWT Auth policy to a route in your project. - -1. In the [Zuplo Portal](https://portal.zuplo.com) open the **Route Designer** - in the **Files** tab then click **routes.oas.json**. - -2. Select or create a route that you want to authenticate with Auth0. Expand the - **Policies** section and click **Add Policy**. Search for and select the - Auth0 JWT Auth policy. - - - -3. With the policy selected, notice that there are two properties, `auth0Domain` - and `audience` that are pre-populated with environment variable names that - you set in the previous section. - - - -4. Click **OK** to save the policy. - -### Test the Policy - -Finally, you'll make two API requests to your route to test that authentication -is working as expected. - -1. In the route designer on the route you added the policy, click the **Test** - button. In the dialog that opens, click **Test** to make a request. - -2. The API Gateway should respond with a **401 Unauthorized** response. - - - -3. Now to make an authenticated request, add a header to the request called - `Authorization`. Set the value of the header to `Bearer YOUR_ACCESS_TOKEN` - replacing `YOUR_ACCESS_TOKEN` with the value of the Auth0 access token you - saved from the first section of this tutorial. - - - -4. Click the **Test** button and a **200 OK** response should be returned. - - - -You have now setup Auth0 JWT Authentication on your API Gateway. - -See [this document](/docs/articles/oauth-authentication) for more information -about OAuth authorization in Zuplo.