resolver
configuration option is used in conjunction with NATS JWT Authentication and nsc. The resolver
option specifies a URL where the nats-server can retrieve an account JWT. There are 3 resolver implementations:URL
if you want to build your own account service, typically in order to have some integration of NATS security with some external security system.If the operator JWT specified inoperator
contains an account resolver URL,resolver
only needs to be specified in order to overwrite that default.
nats-server
and stores the account JWTs in a local (not shared) directory that the server has access to (i.e. you can't have more than one nats-server
s using the same directory. All the servers in the cluster or super-cluster must be configured to use it, and they implement an 'eventually consistent' mechanism via NATS and the system account to synchronize (or lookup) the account data between themselves.nats-server
(i.e. if you have a lot of accounts), this resolver has two sub types full
and cache
.nsc
CLI tool to create/manage the JWTs locally, and use nsc push
to push new JWTs to the nats-servers' built-in resolvers, nsc pull
to refresh their local copy of account JWTs, and nsc revocations
to revoke them.nats-server
stores all JWTs and exchanges them in an eventually consistent way with other resolvers of the same type.resolver_preload
. When present, JWTs are listed and stored in the resolver. There, they may be subject to updates. Restarts of the nats-server
will hold on to these more recent versions.full
. You need enough to still serve your workload adequately, while some servers are offline.nats-server
only stores a subset of the JWTs and evicts others based on an LRU scheme. Missing JWTs are downloaded from the full
nats based resolver(s).nsc
, send it as a request to $SYS.REQ.CLAIMS.UPDATE
. Each participating full
NATS based account resolver will respond with a message detailing success or failure.$SYS.REQ.ACCOUNT.*.CLAIMS.LOOKUP
and respond with the account JWT corresponding to the requested account id (wildcard).nsc
:nsc pull
to make sure you have a copy of all the account data in the server in your local machinensc edit operator --account-jwt-server-url <nats://...>
nsc push -A
to push your account data to the nats-servers using the built-in nats account resolvernsc pull
and nsc push
commands.MEMORY
resolver is statically configured in the server's configuration file. You would use this mode if you would rather manage the account resolving 'by hand' through the nat-server
s' configuration files. The memory resolver makes use of the resolver_preload
directive, which specifies a map of public keys to account JWTs:MEMORY
resolver is recommended when the server has a small number of accounts that don't change very often.URL
resolver specifies a URL where the server can append an account public key to retrieve that account's JWT. Convention for standalone NATS Account JWT Servers is to serve JWTs at: http://localhost:9090/jwt/v1/accounts/
. For such a configuration you would specify the resolver as follows:Note that if you are not using a nats-account-server, the URL can be anything as long as by appending the public key for an account, the requested JWT is returned.
resolver_tls
. This tls
configuration map lets you further restrict TLS to the resolver.