Auth Callout

[alberk8]

Is there support for Auth Callout in V2?

[mtmk]

I think @caleblloyd knows the detailed answer, I remember someone asking the same question on Slack (http://slack.nats.io #dotnet). One thing I know it need some JWT support and the NATS.Jwt .NET library is being worked on as we speak. preview should be out very soon. Also, Jeremy's new video https://youtu.be/VvGxrT-jv64 explains how auth callout works with an example using OIDC I think (I haven't seen it yet). Or maybe you've seen it hence the question :)

[alberk8]

Thanks. I asked the question after watching the video :).

[mtmk]

update: NATS.Jwt and NATS.NKeys packages are in preview afaiu with enough functionality to implement auth callout

edit: an example implementation is boing worked on by some of our contributers but any other examples would be welcome as well of course ;)

[garrett-sutton]

Have there been any updates on this? If so, where might I find examples or other documentation?

[mtmk]

unfortunately I am not aware of any .NET examples yet. in the mean time NATS by Example might be helpful:
https://natsbyexample.com/examples/auth/callout-decentralized/cli
https://github.com/ConnectEverything/nats-by-example/tree/main/examples/auth/callout-decentralized/cli

[garrett-sutton]

Thanks for sharing. A follow-up question that
is maybe better directed somewhere else (please tell me if so). But I'm wondering how/if the new v2 library supports renewing a jwt when the expiry (set by auth callouts service on the jet) is reached?

I'm specifically wondering about feature parity with the go library.
In the nats.go library, it seems that if a client initiates a connection to a nats server that is configured for auth callouts, the client can specify a TokenHandler as a connection option. That handler is invoked on the initial connection and then invoked at some point up to the expiry of the token that was signed by the auth callouts service.

In my testing of a .NET client that uses the library, I'm not observing this behavior (specifically an indication that the token expired and must be renewed to proceed) but I'm also not sure if somehow it's just hidden from me.

Thanks in advance.

[mtmk]

good question we don't have that in .net client. I didn't know about a token handler in go client. if it's needed we can definitely add it. Let me know if you figure it out or feel free to pop an issue or a PR in. fair few people have been interested in auth callouts it would be nice to have a good end to end solution and examples for it. btw we have a slack channel as well if you use that https://slack.nats.io

[garrett-sutton]

I think what I'm asking for is what is proposed in #356. Leaving a comment over there.