The code (PHP) follows. As to the question about seeing a new oauth user, I don't see any new users created after the JWT exchange. Also, the JWT exchange is successful and generate an access token that results in a successful asset api request that is identical to my request made with a local development token, except that the metadata property is empty.
<?php
declare(strict_types=1);
namespace LAZ\objects\shared\AdobeExperienceManager\services;
use Doctrine\Common\Cache\Cache;
use Exception;
use Firebase\JWT\JWT;
use GuzzleHttp\Client;
use LAZ\objects\library\HttpStatus;
use LAZ\objects\library\Router\Exception\ForbiddenException;
use LAZ\objects\shared\AdobeExperienceManager\AccessTokenProvider;
use LAZ\objects\shared\AdobeExperienceManager\LazAemInstance;
use stdClass;
class AemServiceCredentialAuthService implements AccessTokenProvider
{
const EXPIRATION_SECONDS_INTERVAL = 60 * 60;
private Cache $cache;
private LazAemInstance $aemInstance;
public function __construct(Cache $cache, LazAemInstance $aemInstance)
{
$this->cache = $cache;
$this->aemInstance = $aemInstance;
}
public function getServiceCredentials(): ?stdClass {
$aemEnv = $_ENV['AEM_AUTHORING_ENV'];
$aemVaultDir = $_ENV['AEM_VAULT_DIR'];
$serviceTokenFile = "$aemVaultDir/service_token_$aemEnv.json";
$credentialsStr = file_get_contents($serviceTokenFile);
if ($credentialsStr === false) {
throw new Exception("Unable to read AEM service credentials from $serviceTokenFile");
}
return json_decode($credentialsStr);
}
public function exchangeJwt(stdClass $options stdClass {
$imsEndpoint = $options->imsEndpoint;
$clientId = $options->clientId;
$jwtPayload = [
'iss' => $options->issuer,
'sub' => $options->subject,
'exp' => $options->expirationTimeSeconds,
'aud' => "https://$imsEndpoint/c/$clientId",
];
foreach ($options->metascopes as $metascope) {
$metascopeKey = "https://$imsEndpoint/s/$metascope";
$jwtPayload[$metascopeKey] = true;
}
$jwtToken = JWT::encode($jwtPayload, $options->privateKey, 'RS256');
$client = new Client();
$uri = "https://$imsEndpoint/ims/exchange/jwt";
$response = $client->post($uri, [
'form_params' => [
'client_id' => $options->clientId,
'client_secret' => $options->clientSecret,
'jwt_token' => $jwtToken,
],
// 'debug' => fopen($_ENV['LOG_PATH'] . '/GuzzleHttp.log', 'a+'),
]);
$statusCode = $response->getStatusCode();
if ($response->getStatusCode() !== HttpStatus::OK) {
if (in_array($response->getStatusCode(), [HttpStatus::UNAUTHORIZED, HttpStatus::FORBIDDEN])) {
throw new ForbiddenException();
}
throw new Exception("Bad status: $statusCode @ $uri\n");
}
return json_decode($response->getBody()->getContents());
}
public function getAccessToken(): string {
$cacheKey = 'AemServiceCredential.AccessToken.' . $this->aemInstance->getAuthoringHost();
$accessToken = $this->cache->fetch($cacheKey);
if ($accessToken === FALSE) {
$accessToken = $this->getAccessTokenFromServiceCredentials();
$this->cache->save($cacheKey, $accessToken);
}
return $accessToken->access_token;
}
public function getAccessTokenFromServiceCredentials(): stdClass {
$serviceCredentials = $this->getServiceCredentials();
return $this->exchangeJwt((object)[
'imsEndpoint' => $serviceCredentials->integration->imsEndpoint,
'issuer' => $serviceCredentials->integration->org,
'subject' => $serviceCredentials->integration->id,
'expirationTimeSeconds' => time() + self::EXPIRATION_SECONDS_INTERVAL,
'metascopes' => explode(',', $serviceCredentials->integration->metascopes),
'clientId' => $serviceCredentials->integration->technicalAccount->clientId,
'clientSecret' => $serviceCredentials->integration->technicalAccount->clientSecret,
'privateKey' => $serviceCredentials->integration->privateKey,
]);
}
}
