tokenx-auth

TokenX Authentication Skill

This skill provides patterns for secure service-to-service authentication using TokenX.

Workflow

1. Enable TokenX in the Nais manifest and define access policies
2. Implement token exchange (basic or with caching)
3. Call downstream services with the exchanged token
4. Validate inbound TokenX tokens on protected endpoints
5. Integrate with Ktor authentication
6. Test with MockOAuth2Server

1. Nais Manifest Setup

apiVersion: nais.io/v1alpha1
kind: Application
metadata:
  name: my-app
spec:
  tokenx:
    enabled: true

  accessPolicy:
    outbound:
      rules:
        - application: user-service
          namespace: team-user

This creates environment variables:

• TOKEN_X_WELL_KNOWN_URL
• TOKEN_X_CLIENT_ID
• TOKEN_X_PRIVATE_JWK

2. Token Exchange with Caching

Production pattern from navikt/tms-ktor-token-support - used across 198+ Nav repositories:

import com.github.benmanes.caffeine.cache.Cache
import com.github.benmanes.caffeine.cache.Caffeine
import com.nimbusds.jose.jwk.RSAKey

class CachingTokendingsService(
    private val tokendingsConsumer: TokendingsConsumer,
    private val jwtAudience: String,
    private val clientId: String,
    privateJwk: String,
    maxCacheEntries: Long = 10000,
    cacheExpiryMarginSeconds: Int = 10
) : TokendingsService {

    private val cache: Cache<String, AccessTokenEntry> = Caffeine.newBuilder()
        .maximumSize(maxCacheEntries)
        .expireAfter(ExpiryPolicy(cacheExpiryMarginSeconds))
        .build()

    private val privateRsaKey = RSAKey.parse(privateJwk)

    override suspend fun exchangeToken(token: String, targetApp: String): String {
        val cacheKey = "$token:$targetApp".hashCode().toString()
        return cache.get(cacheKey) {
            performTokenExchange(token, targetApp)
        }.accessToken
    }

    private suspend fun performTokenExchange(
        token: String,
        targetApp: String
    ): AccessTokenEntry {
        val clientAssertion = createSignedAssertion(clientId, jwtAudience, privateRsaKey)
        return tokendingsConsumer.exchangeToken(
            subjectToken = token,
            clientAssertion = clientAssertion,
            targetApp = "cluster:namespace:$targetApp"
        )
    }
}