modules/aaa/mod_autht_jwt.c

/* Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/**
 * This module adds support for https://tools.ietf.org/html/rfc7519 JWT tokens
 * as https://tools.ietf.org/html/rfc6750 Bearer tokens, both as a generator
 * of JWT bearer tokens, and as an acceptor of JWT Bearer tokens for authentication.
 */

/* apr_jose support requires >= 1.7 */
#if APU_MAJOR_VERSION > 1 || \
    (APU_MAJOR_VERSION == 1 && APU_MINOR_VERSION > 6)
#define HAVE_APU_JOSE 1
#endif

#include "httpd.h"
#include "http_config.h"

#ifdef HAVE_APU_JOSE

#include "apr_strings.h"
#include "apr_hash.h"
#include "apr_crypto.h"
#include "apr_jose.h"
#include "apr_lib.h"            /* for apr_isspace */
#include "apr_base64.h"         /* for apr_base64_decode et al */
#define APR_WANT_STRFUNC        /* for strcasecmp */
#include "apr_want.h"

#include "ap_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
#include "util_md5.h"
#include "ap_provider.h"
#include "ap_expr.h"

#include "mod_auth.h"

#define CRYPTO_KEY "auth_bearer_context"

module AP_MODULE_DECLARE_DATA autht_jwt_module;

typedef enum jws_alg_type_e {
    /** No specific type. */
    JWS_ALG_TYPE_NONE = 0,
    /** HMAC SHA256 */
    JWS_ALG_TYPE_HS256 = 1,
} jws_alg_type_e;

typedef struct {
    unsigned char *secret;
    apr_size_t secret_len;
    jws_alg_type_e jws_alg;
} auth_bearer_signature_rec;

typedef struct {
    apr_hash_t *claims;
    apr_array_header_t *signs;
    apr_array_header_t *verifies;
    unsigned int signs_set      :1,
                 verifies_set   :1;
} auth_bearer_config_rec;

typedef struct {
    const char *library;
    const char *params;
    apr_crypto_t **crypto;
    unsigned int library_set    :1;
} auth_bearer_conf;

static int auth_bearer_init(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp,
        server_rec *s) {
    const apr_crypto_driver_t *driver = NULL;

    /* auth_bearer_init() will be called twice. Don't bother
     * going through all of the initialization on the first call
     * because it will just be thrown away.*/
    if (ap_state_query(AP_SQ_MAIN_STATE) == AP_SQ_MS_CREATE_PRE_CONFIG) {
        return OK;
    }

    while (s) {

        auth_bearer_conf *conf = ap_get_module_config(s->module_config,
                &autht_jwt_module);

        if (conf->library_set && !*conf->crypto) {

            const apu_err_t *err = NULL;
            apr_status_t rv;

            rv = apr_crypto_init(p);
            if (APR_SUCCESS != rv) {
                ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
                        APLOGNO(10432) "APR crypto could not be initialised");
                return rv;
            }

            rv = apr_crypto_get_driver(&driver, conf->library, conf->params,
                    &err, p);
            if (APR_EREINIT == rv) {
                ap_log_error(APLOG_MARK, APLOG_WARNING, rv, s,
                        APLOGNO(10433) "warning: crypto for '%s' was already initialised, " "using existing configuration",
                        conf->library);
                rv = APR_SUCCESS;
            }
            if (APR_SUCCESS != rv && err) {
                ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
                        APLOGNO(10434) "The crypto library '%s' could not be loaded: %s (%s: %d)",
                        conf->library, err->msg, err->reason, err->rc);
                return rv;
            }
            if (APR_ENOTIMPL == rv) {
                ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
                        APLOGNO(10435) "The crypto library '%s' could not be found",
                        conf->library);
                return rv;
            }
            if (APR_SUCCESS != rv || !driver) {
                ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
                        APLOGNO(10436) "The crypto library '%s' could not be loaded",
                        conf->library);
                return rv;
            }

            rv = apr_crypto_make(conf->crypto, driver, conf->params, p);
            if (APR_SUCCESS != rv) {
                ap_log_error(APLOG_MARK, APLOG_ERR, rv, s,
                        APLOGNO(10437) "The crypto library '%s' could not be initialised",
                        conf->library);
                return rv;
            }

            ap_log_error(APLOG_MARK, APLOG_INFO, rv, s,
                    APLOGNO(10438) "The crypto library '%s' was loaded successfully",
                    conf->library);

        }

        s = s->next;
    }

    return OK;
}

static void *create_auth_bearer_config(apr_pool_t * p, server_rec *s)
{
    auth_bearer_conf *new =
    (auth_bearer_conf *) apr_pcalloc(p, sizeof(auth_bearer_conf));

    /* if no library has been configured, set the recommended library
     * as a sensible default.
     */
#ifdef APU_CRYPTO_RECOMMENDED_DRIVER
    new->library = APU_CRYPTO_RECOMMENDED_DRIVER;
#endif
    new->crypto = apr_pcalloc(p, sizeof(apr_crypto_t *));

    return (void *) new;
}

static void *merge_auth_bearer_config(apr_pool_t * p, void *basev, void *addv)
{
    auth_bearer_conf *new = (auth_bearer_conf *) apr_pcalloc(p, sizeof(auth_bearer_conf));
    auth_bearer_conf *add = (auth_bearer_conf *) addv;
    auth_bearer_conf *base = (auth_bearer_conf *) basev;

    new->library = (add->library_set == 0) ? base->library : add->library;
    new->params = (add->library_set == 0) ? base->params : add->params;
    new->library_set = add->library_set || base->library_set;

    new->crypto = base->crypto;

    return (void *) new;
}

static void *create_auth_bearer_dir_config(apr_pool_t *p, char *d)
{
    auth_bearer_config_rec *conf = apr_pcalloc(p, sizeof(*conf));

    conf->claims = apr_hash_make(p);
    conf->signs = apr_array_make(p, 1, sizeof(auth_bearer_signature_rec));
    conf->verifies = apr_array_make(p, 1, sizeof(auth_bearer_signature_rec));

    return conf;
}

static void *merge_auth_bearer_dir_config(apr_pool_t *p, void *basev, void *overridesv)
{
    auth_bearer_config_rec *newconf = apr_pcalloc(p, sizeof(*newconf));
    auth_bearer_config_rec *base = basev;
    auth_bearer_config_rec *overrides = overridesv;

    newconf->claims = apr_hash_overlay(p, overrides->claims,
                                          base->claims);

    newconf->signs =
            overrides->signs_set ? overrides->signs : base->signs;
    newconf->signs_set = overrides->signs_set || base->signs_set;

    newconf->verifies =
            overrides->verifies_set ? overrides->verifies : base->verifies;
    newconf->verifies_set = overrides->verifies_set || base->verifies_set;

    return newconf;
}

static const char *set_jwt_claim(cmd_parms *cmd, void *config,
        const char *op, const char *key, const char *expression)
{
    auth_bearer_config_rec *conf = (auth_bearer_config_rec *) config;
    const char *err;

    if (!strcasecmp(op, "set")) {
        ap_expr_info_t *expr;

        expr = ap_expr_parse_cmd(cmd, expression, AP_EXPR_FLAG_STRING_RESULT,
                &err, NULL);
        if (err) {
            return apr_psprintf(cmd->pool,
                    "Could not parse claim '%s' expression '%s': %s", key,
                    expression, err);
        }

        apr_hash_set(conf->claims, key, APR_HASH_KEY_STRING, expr);

    } else if (!strcasecmp(op, "unset")) {

        apr_hash_set(conf->claims, key, APR_HASH_KEY_STRING, NULL);

    } else {

        return apr_psprintf(cmd->pool,
                "Could not parse claim operation '%s', "
                "values should be 'set' or 'unset'", op);

    }

    return NULL;
}

static const char *set_jwt_sign(cmd_parms * cmd, void *config,
        const char *alg, const char *type, const char *sig)
{
    auth_bearer_config_rec *dconf = (auth_bearer_config_rec *) config;

    auth_bearer_signature_rec *srec = apr_array_push(dconf->signs);

    /* handle the algorithm */
    if (!strcasecmp(alg, "none")) {
        srec->jws_alg = JWS_ALG_TYPE_NONE;
        if (type || sig) {
            return "AuthtJwtSign: algorithm 'none' has extra parameters";
        }
    }
    else if (!strcasecmp(alg, "HS256")) {
        srec->jws_alg = JWS_ALG_TYPE_HS256;
    }
    else {
        return apr_psprintf(cmd->pool, "AuthtJwtSign: algorithm not supported: %s", alg);
    }

    /* handle the file */
    if (type) {
        if (!strcasecmp(type, "file")) {
            apr_file_t *file;
            apr_finfo_t finfo;
            apr_status_t status;

            sig = ap_server_root_relative(cmd->temp_pool, sig);

            status = apr_file_open(&file, sig, APR_READ | APR_BUFFERED,
            APR_OS_DEFAULT, cmd->pool);
            if (status != APR_SUCCESS) {
                char buf[1024];
                apr_strerror(status, buf, sizeof(buf));
                return apr_psprintf(cmd->pool,
                        "AuthtJwtSign: file '%s' could not be opened: %s", sig,
                        buf);
            }

            status = apr_file_info_get(&finfo, APR_FINFO_TYPE | APR_FINFO_SIZE,
                    file);
            if (status != APR_SUCCESS) {
                char buf[1024];
                apr_strerror(status, buf, sizeof(buf));
                return apr_psprintf(cmd->pool,
                        "AuthtJwtSign: info could not be obtained for '%s': %s",
                        sig, buf);
            }

            srec->secret = apr_palloc(cmd->pool, finfo.size);
            srec->secret_len = finfo.size;

            status = apr_file_read_full(file, srec->secret,
                    srec->secret_len, NULL);
            if (status != APR_SUCCESS) {
                char buf[1024];
                apr_strerror(status, buf, sizeof(buf));
                return apr_psprintf(cmd->pool,
                        "AuthtJwtSign: file '%s' could not be read: %s", sig,
                        buf);
            }

            apr_file_close(file);

        }
        else {
            return apr_psprintf(cmd->pool,
                    "AuthtJwtSign: parameter '%s' is not 'file'", type);
        }
    }

    dconf->signs_set = 1;

    return NULL;
}

static const char *set_jwt_verify(cmd_parms * cmd, void *config,
        const char *alg, const char *type, const char *sig)
{
    auth_bearer_config_rec *dconf = (auth_bearer_config_rec *) config;

    auth_bearer_signature_rec *srec = apr_array_push(dconf->verifies);

    /* handle the algorithm */
    if (!strcasecmp(alg, "none")) {
        srec->jws_alg = JWS_ALG_TYPE_NONE;
        if (type || sig) {
            return "AuthtJwtVerify: algorithm 'none' has extra parameters";
        }
    }
    else if (!strcasecmp(alg, "HS256")) {
        srec->jws_alg = JWS_ALG_TYPE_HS256;
    }
    else {
        return apr_psprintf(cmd->pool, "AuthtJwtVerify: algorithm not supported: %s", alg);
    }

    /* handle the file */
    if (type) {
        if (!strcasecmp(type, "file")) {
            apr_file_t *file;
            apr_finfo_t finfo;
            apr_status_t status;

            sig = ap_server_root_relative(cmd->temp_pool, sig);

            status = apr_file_open(&file, sig, APR_READ | APR_BUFFERED,
            APR_OS_DEFAULT, cmd->pool);
            if (status != APR_SUCCESS) {
                char buf[1024];
                apr_strerror(status, buf, sizeof(buf));
                return apr_psprintf(cmd->pool,
                        "AuthtJwtVerify: file '%s' could not be opened: %s", sig,
                        buf);
            }

            status = apr_file_info_get(&finfo, APR_FINFO_TYPE | APR_FINFO_SIZE,
                    file);
            if (status != APR_SUCCESS) {
                char buf[1024];
                apr_strerror(status, buf, sizeof(buf));
                return apr_psprintf(cmd->pool,
                        "AuthtJwtVerify: info could not be obtained for '%s': %s",
                        sig, buf);
            }

            srec->secret = apr_palloc(cmd->pool, finfo.size);
            srec->secret_len = finfo.size;

            status = apr_file_read_full(file, srec->secret,
                    srec->secret_len, NULL);
            if (status != APR_SUCCESS) {
                char buf[1024];
                apr_strerror(status, buf, sizeof(buf));
                return apr_psprintf(cmd->pool,
                        "AuthtJwtVerify: file '%s' could not be read: %s", sig,
                        buf);
            }

            apr_file_close(file);

        }
        else {
            return apr_psprintf(cmd->pool,
                    "AuthtJwtVerify: parameter '%s' is not 'file'", type);
        }
    }

    dconf->verifies_set = 1;

    return NULL;
}

static const char *set_jwt_driver(cmd_parms * cmd, void *config, const char *arg)
{
    auth_bearer_conf *conf =
            (auth_bearer_conf *)ap_get_module_config(cmd->server->module_config,
            &autht_jwt_module);

    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);

    if (err != NULL) {
        return err;
    }

    conf->library = ap_getword_conf(cmd->pool, &arg);
    conf->params = arg;
    conf->library_set = 1;

    return NULL;
}

static const command_rec auth_bearer_cmds[] =
{
    AP_INIT_TAKE13("AuthtJwtVerify", set_jwt_verify, NULL, RSRC_CONF|OR_AUTHCFG,
                   "The JWS signing algorithm and passphrase/key to verify an incoming JWT token"),
    AP_INIT_TAKE13("AuthtJwtSign", set_jwt_sign, NULL, RSRC_CONF|OR_AUTHCFG,
            "The JWS signing algorithm and passphrase/key to sign an outgoing JWT token"),

    AP_INIT_TAKE23("AuthtJwtClaim", set_jwt_claim, NULL, OR_AUTHCFG,
            "Set a claim with the given name and expression, or "
            "unset the claim with the given name."),

    AP_INIT_RAW_ARGS("AuthtJwtDriver", set_jwt_driver, NULL, RSRC_CONF,
            "The underlying crypto library driver to use"),

    {NULL}
};

typedef struct claim_iter_t {
    request_rec *r;
    apr_json_value_t *object;
} claim_iter_t;

static int claim_iter(void *ctx, const void *key, apr_ssize_t klen,
                     const void *val)
{
    const char *err, *value;
    claim_iter_t *iter = ctx;
    request_rec *r = iter->r;

    value = ap_expr_str_exec(r, val, &err);
    if (err) {
        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10439)
                "AuthtJwtClaim: could not evaluate '%s' expression "
                "'%s' for URI '%s': %s",
                (char * )key, (char * )val, r->uri, err);
        return FALSE;
    }


    apr_json_object_set(iter->object, key, klen,
            apr_json_string_create(r->pool, value, strlen(value)), r->pool);

    return TRUE;
}

static apr_status_t sign_cb(apr_bucket_brigade *bb, apr_jose_t *jose,
        apr_jose_signature_t *signature, void *ctx, apr_pool_t *pool) {
    auth_bearer_signature_rec *srec = NULL;
    request_rec *r = ctx;

    auth_bearer_conf *sconf = ap_get_module_config(r->server->module_config,
            &autht_jwt_module);

    auth_bearer_config_rec *conf = ap_get_module_config(r->per_dir_config,
            &autht_jwt_module);

    if (conf->signs_set) {
        srec = (auth_bearer_signature_rec *) conf->signs->elts;
    }

    if (srec) {
        switch (srec->jws_alg) {
        case JWS_ALG_TYPE_NONE: {

            return APR_SUCCESS;
        }
        case JWS_ALG_TYPE_HS256: {
            apr_bucket *e;
            apr_crypto_key_rec_t *krec;
            apr_crypto_key_t *key = NULL;
            apr_crypto_digest_t *digest = NULL;
            apr_crypto_digest_rec_t *rec;
            char * buf;
            apr_status_t status;

            if (!*sconf->crypto) {
                jose->result.msg = "token could not be signed";
                jose->result.reason = "no crypto driver configured (set AuthtJwtDriver)";
                return APR_EGENERAL;
            }

            krec = apr_crypto_key_rec_make(APR_CRYPTO_KTYPE_HMAC, pool);

            krec->k.hmac.digest = APR_CRYPTO_DIGEST_SHA256;
            krec->k.hmac.secret = srec->secret;
            krec->k.hmac.secretLen = srec->secret_len;

            status = apr_crypto_key(&key, krec, *sconf->crypto, pool);
            if (status != APR_SUCCESS) {
                jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                apr_strerror(status, buf, HUGE_STRING_LEN);
                jose->result.msg = "token could not be signed";
                return status;
            }

            rec = apr_crypto_digest_rec_make(APR_CRYPTO_DTYPE_SIGN, pool);

            status = apr_crypto_digest_init(&digest, key, rec, pool);
            if (status != APR_SUCCESS) {
                jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                apr_strerror(status, buf, HUGE_STRING_LEN);
                jose->result.msg = "token could not be signed";
                return status;
            }

            for (e = APR_BRIGADE_FIRST(bb); e != APR_BRIGADE_SENTINEL(bb); e =
                    APR_BUCKET_NEXT(e)) {
                const char *str;
                apr_size_t len;

                /* If we see an EOS, don't bother doing anything more. */
                if (APR_BUCKET_IS_EOS(e)) {
                    break;
                }

                status = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);
                if (status != APR_SUCCESS) {
                    jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                    apr_strerror(status, buf, HUGE_STRING_LEN);
                    jose->result.msg = "token could not be signed";
                    return status;
                }

                status = apr_crypto_digest_update(digest,
                        (const unsigned char *) str, len);
                if (status != APR_SUCCESS) {
                    jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                    apr_strerror(status, buf, HUGE_STRING_LEN);
                    jose->result.msg = "token could not be signed";
                    return status;
                }
            }

            status = apr_crypto_digest_final(digest);
            if (status != APR_SUCCESS) {
                jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                apr_strerror(status, buf, HUGE_STRING_LEN);
                jose->result.msg = "token could not be signed";
                return status;
            }

            signature->sig.data = rec->d.sign.s;
            signature->sig.len = rec->d.sign.slen;

            return APR_SUCCESS;
        }
        }
    }
    else {
        /* algorithm is none */
        return APR_SUCCESS;
    }

    return APR_ENOTIMPL;
}

/* If we have set claims to be made, create a JWT token.
 */
static const char *jwt_get_token(request_rec *r)
{
    claim_iter_t iter = { 0 };
    apr_json_value_t *claims;
    apr_json_value_t *protect;
    apr_jose_t jwt = { 0 };
    apr_jose_t jws = { 0 };
    apr_jose_signature_t signature = { 0 };
    auth_bearer_signature_rec *srec = NULL;
    apr_bucket_brigade *bb;
    char *auth_line;
    apr_size_t len;
    apr_off_t offset;
    apr_status_t status;

    auth_bearer_config_rec *conf = ap_get_module_config(r->per_dir_config,
                                                       &autht_jwt_module);

    apr_jose_cb_t cb = { 0 };

    cb.sign = sign_cb;
    cb.ctx = r;

    if (!conf->claims || !apr_hash_count(conf->claims)) {
        ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r,
                APLOGNO(10440) "AuthtJwtClaim: could not encode a JWT token for URI '%s': no claims",
                r->uri);
        return "error:no-claims";
    }

    /* sign with the first key, if present */
    if (conf->signs_set) {
        srec = (auth_bearer_signature_rec *)conf->signs->elts;
    }

    /* create a JWT containing the claims */
    claims = apr_json_object_create(r->pool);
    iter.object = claims;
    iter.r = r;

    /* iterate through our claims */
    if (!apr_hash_do(claim_iter, &iter, conf->claims)) {
        return "error:claim-failed";
    }

    apr_jose_jwt_make(&jwt, claims, r->pool);
    protect = apr_json_object_create(r->pool);

    apr_json_object_set(protect, APR_JOSE_JWSE_TYPE,
            APR_JSON_VALUE_STRING,
            apr_json_string_create(r->pool, APR_JOSE_JWSE_TYPE_JWT,
                    APR_JSON_VALUE_STRING), r->pool);

    if (srec) {
        /* which signature type do we have? */
        switch (srec->jws_alg) {
        case JWS_ALG_TYPE_NONE: {
            apr_json_object_set(protect, APR_JOSE_JWKSE_ALGORITHM,
                    APR_JSON_VALUE_STRING,
                    apr_json_string_create(r->pool, APR_JOSE_JWA_NONE,
                            APR_JSON_VALUE_STRING), r->pool);

            break;
        }
        case JWS_ALG_TYPE_HS256: {
            apr_json_object_set(protect, APR_JOSE_JWKSE_ALGORITHM,
                    APR_JSON_VALUE_STRING,
                    apr_json_string_create(r->pool, APR_JOSE_JWA_HS256,
                            APR_JSON_VALUE_STRING), r->pool);

            break;
        }
        }

    }
    else {
        /* no srec defaults to none */
        apr_json_object_set(protect, APR_JOSE_JWKSE_ALGORITHM,
                APR_JSON_VALUE_STRING,
                apr_json_string_create(r->pool, APR_JOSE_JWA_NONE,
                        APR_JSON_VALUE_STRING), r->pool);
    }

    apr_jose_signature_make(&signature, NULL, protect, r->pool);
    apr_jose_jws_make(&jws, &signature, NULL, &jwt, r->pool);

    bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);

    status = apr_jose_encode(bb, NULL, NULL, &jws, &cb, r->pool);
    if (APR_SUCCESS != status) {
        const apu_err_t *err = apr_jose_error(&jws);
        ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
                APLOGNO(10441) "AuthtJwtClaim: could not encode a JWT token for URI '%s': %s: %s",
                r->uri, err->msg, err->reason);
        return "error:could-not-encode";
    }

    apr_brigade_length(bb, 1, &offset);
    auth_line = apr_pcalloc(r->pool, offset + 1);
    len = offset;
    apr_brigade_flatten(bb, auth_line, &len);
    auth_line[offset] = 0;

    return auth_line;
}

static const char *jwt_expr_var_fn(ap_expr_eval_ctx_t *ctx, const void *data)
{
    char *var = (char *)data;

    if (var && *var && ctx->r && ap_cstr_casecmp(var, "TOKEN") == 0) {
        return jwt_get_token(ctx->r);
    }
    return NULL;
}

static int jwt_expr_lookup(ap_expr_lookup_parms *parms)
{
    switch (parms->type) {
    case AP_EXPR_FUNC_VAR:
        /* for now, we just handle everything that starts with JWT_.
         */
        if (strncasecmp(parms->name, "JWT_", 4) == 0) {
            *parms->func = jwt_expr_var_fn;
            *parms->data = parms->name + 4;
            return OK;
        }
        break;
    }
    return DECLINED;
}

static apr_status_t verify_cb(apr_bucket_brigade *bb,
        apr_jose_t *jose, apr_jose_signature_t *signature, void *ctx,
        int *vflags, apr_pool_t *pool)
{
    request_rec *r = ctx;
    apr_json_kv_t *alg = NULL;

    auth_bearer_conf *sconf = ap_get_module_config(r->server->module_config,
            &autht_jwt_module);

    auth_bearer_config_rec *conf = ap_get_module_config(r->per_dir_config,
                                                       &autht_jwt_module);

    int alg_supported = 0;

    if (signature) {
        apr_json_value_t *ph = signature->protected_header;

        if (ph && ph->type == APR_JSON_OBJECT) {

            alg = apr_json_object_get(ph, APR_JOSE_JWKSE_ALGORITHM,
                    APR_JSON_VALUE_STRING);

        }
    }

    if (!alg) {
        apr_errprintf(&jose->result, r->pool, "", APR_EGENERAL,
                "JWT token protected header has no '"
                APR_JOSE_JWKSE_ALGORITHM
                "' for URI '%s'",
                r->uri);
        return APR_EGENERAL;
    }

    if (alg->v->type != APR_JSON_STRING) {
        apr_errprintf(&jose->result, r->pool, "", APR_EGENERAL,
                "JWT token protected header '"
                APR_JOSE_JWKSE_ALGORITHM
                "' is not a string for URI '%s'",
                r->uri);
        return APR_EGENERAL;
    }

    /* first pass, is our algorithm supported? */
    for (int i = 0; i < conf->verifies->nelts; i++) {
    	auth_bearer_signature_rec *srec = &APR_ARRAY_IDX(conf->verifies,
    			i, auth_bearer_signature_rec);

    	/* which signature type do we have? */
    	switch (srec->jws_alg) {
    	case JWS_ALG_TYPE_NONE: {
        	if (!strncmp(alg->v->value.string.p, "none",
                        alg->v->value.string.len)) {
        		alg_supported = 1;
        	}
        	break;
    	}
    	case JWS_ALG_TYPE_HS256: {
        	if (!strncmp(alg->v->value.string.p, "HS256",
        			alg->v->value.string.len)) {
        		alg_supported = 1;
        	}
    		break;
    	}
    	}

    }

    /* we don't support the algorithm */
    if (!alg_supported) {
    	apr_errprintf(&jose->result, r->pool, "", APR_ENODIGEST,
    			"JWT token protected header '"
    			APR_JOSE_JWKSE_ALGORITHM
				"' %s is not supported for URI '%s'",
				alg->v->value.string.p, r->uri);
    	return APR_ENODIGEST;
    }

    /* second pass, does the signature match? */
    for (int i = 0; i < conf->verifies->nelts; i++) {
    	auth_bearer_signature_rec *srec = &APR_ARRAY_IDX(conf->verifies,
    			i, auth_bearer_signature_rec);

    	/* which signature type do we have? */
    	switch (srec->jws_alg) {
    	case JWS_ALG_TYPE_NONE: {
        	if (!strncmp(alg->v->value.string.p, "none",
                        alg->v->value.string.len)) {
        		return APR_SUCCESS;
        	}
        	break;
    	}
    	case JWS_ALG_TYPE_HS256: {
        	if (!strncmp(alg->v->value.string.p, "HS256",
        			alg->v->value.string.len)) {

                apr_bucket *e;
                apr_crypto_key_rec_t *krec;
                apr_crypto_key_t *key = NULL;
                apr_crypto_digest_t *digest = NULL;
                apr_crypto_digest_rec_t *rec;
                char * buf;
                apr_status_t status;

                if (!*sconf->crypto) {
                    jose->result.msg = "token could not be verified";
                    jose->result.reason = "no crypto driver configured (set AuthtJwtDriver)";
                    return APR_EGENERAL;
                }

                krec = apr_crypto_key_rec_make(APR_CRYPTO_KTYPE_HMAC, pool);

                krec->k.hmac.digest = APR_CRYPTO_DIGEST_SHA256;
                krec->k.hmac.secret = srec->secret;
                krec->k.hmac.secretLen = srec->secret_len;

                status = apr_crypto_key(&key, krec, *sconf->crypto, pool);
                if (status != APR_SUCCESS) {
                    jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                    apr_strerror(status, buf, HUGE_STRING_LEN);
                    jose->result.msg = "token could not be verified";
                    return status;
                }

                rec = apr_crypto_digest_rec_make(APR_CRYPTO_DTYPE_SIGN, pool);

                status = apr_crypto_digest_init(&digest, key, rec, pool);
                if (status != APR_SUCCESS) {
                    jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                    apr_strerror(status, buf, HUGE_STRING_LEN);
                    jose->result.msg = "token could not be verified";
                    return status;
                }

                for (e = APR_BRIGADE_FIRST(bb); e != APR_BRIGADE_SENTINEL(bb); e =
                        APR_BUCKET_NEXT(e)) {
                    const char *str;
                    apr_size_t len;

                    /* If we see an EOS, don't bother doing anything more. */
                    if (APR_BUCKET_IS_EOS(e)) {
                        break;
                    }

                    status = apr_bucket_read(e, &str, &len, APR_BLOCK_READ);
                    if (status != APR_SUCCESS) {
                        jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                        apr_strerror(status, buf, HUGE_STRING_LEN);
                        jose->result.msg = "token could not be verified";
                        return status;
                    }

                    status = apr_crypto_digest_update(digest,
                            (const unsigned char *) str, len);
                    if (status != APR_SUCCESS) {
                        jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                        apr_strerror(status, buf, HUGE_STRING_LEN);
                        jose->result.msg = "token could not be verified";
                        return status;
                    }
                }

                status = apr_crypto_digest_final(digest);
                if (status != APR_SUCCESS) {
                    jose->result.reason = buf = apr_pcalloc(pool, HUGE_STRING_LEN);
                    apr_strerror(status, buf, HUGE_STRING_LEN);
                    jose->result.msg = "token could not be verified";
                    return status;
                }

                if (signature->sig.len == rec->d.sign.slen &&
                		!memcmp(signature->sig.data, rec->d.sign.s, rec->d.sign.slen)) {
                    return APR_SUCCESS;
                }

        	}
    		break;
    	}
    	}

    }

    /* no match, oh well */
	apr_errprintf(&jose->result, r->pool, "", APR_ENODIGEST,
			"JWT token protected header '"
			APR_JOSE_JWKSE_ALGORITHM
			"' %s is not supported for URI '%s'",
			alg->v->value.string.p, r->uri);
    return APR_ENOVERIFY;
}

static autht_status check_token(request_rec *r, const char *type,
                                   const char *token)
{
    apr_bucket_brigade *bb;
    apr_jose_t *jose = NULL;
    apr_json_kv_t *kv;
    apr_status_t status;

    apr_jose_cb_t cb;

    apr_table_t *e = r->subprocess_env;

    const char *aud = NULL;
    const char *sub = NULL;

    apr_int64_t exp;
    apr_int64_t nbf;

    int exp_set = 0;
    int nbf_set = 0;

    cb.verify = verify_cb;
    cb.decrypt = NULL;
    cb.ctx = r;

    bb = apr_brigade_create(r->pool, r->connection->bucket_alloc);

    if (token) {
        apr_brigade_write(bb, NULL, NULL, token, strlen(token));
    }

    status = apr_jose_decode(&jose, "JWT", bb, &cb, 10, APR_JOSE_FLAG_NONE, r->pool);

    if (APR_SUCCESS != status) {
        const apu_err_t *err = apr_jose_error(jose);
        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
                APLOGNO(10442) "AuthtJwt: could not decode a JWT token for URI '%s': %s: %s",
                r->uri, err->msg, err->reason);
        return AUTHT_DENIED;
    }

    if (jose->type != APR_JOSE_TYPE_JWT) {
        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
                APLOGNO(10443) "AuthtJwt: JOSE token was not a JWT token for URI '%s'",
                r->uri);
        return AUTHT_DENIED;
    }

    /* first pass - identity sub and aud */
    kv = apr_json_object_first(jose->jose.jwt->claims);
    do {

        /* ignore any key that isn't a string */
        if (kv->k->type != APR_JSON_STRING) {
            continue;
        }

        if (!strncmp("aud", kv->k->value.string.p, kv->k->value.string.len)) {
            if (kv->v->type == APR_JSON_STRING) {
                aud = apr_pstrndup(r->pool, kv->v->value.string.p,
                        kv->v->value.string.len);
            }
        }

        if (!strncmp("sub", kv->k->value.string.p, kv->k->value.string.len)) {
            if (kv->v->type == APR_JSON_STRING) {
                sub = apr_pstrndup(r->pool, kv->v->value.string.p,
                        kv->v->value.string.len);
            }
        }

        if (!strncmp("exp", kv->k->value.string.p, kv->k->value.string.len)) {
            if (kv->v->type == APR_JSON_LONG) {
                exp = kv->v->value.lnumber;
                exp_set = 1;
            }
        }

        if (!strncmp("nbf", kv->k->value.string.p, kv->k->value.string.len)) {
            if (kv->v->type == APR_JSON_LONG) {
                nbf = kv->v->value.lnumber;
                nbf_set = 1;
            }
        }


    } while ((kv = apr_json_object_next(jose->jose.jwt->claims, kv)));

    if (!aud) {
        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
                APLOGNO(10444) "AuthtJwt: JWT token 'aud' value was missing and did not match AuthName '%s' for URI '%s'",
                ap_auth_name(r), r->uri);
        return AUTHT_MISMATCH;
    }

    if (strcmp(aud, ap_auth_name(r))) {
        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
                APLOGNO(10445) "AuthtJwt: JWT token 'aud' value '%s' did not match AuthName '%s' for URI '%s'",
                aud, ap_auth_name(r), r->uri);
        return AUTHT_MISMATCH;
    }

    if (exp_set || nbf_set) {
        apr_time_t now = apr_time_now();

        if (exp_set &&
                exp < apr_time_sec(now)) {
            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
                    APLOGNO(10446) "AuthtJwt: JWT token is expired (%"
                    APR_INT64_T_FMT " < %" APR_TIME_T_FMT ") for URI '%s'",
                    exp, apr_time_sec(now), r->uri);
            return AUTHT_EXPIRED;
        }

        if (nbf_set &&
                nbf > apr_time_sec(now)) {
            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, status, r,
                    APLOGNO(10447) "AuthtJwt: JWT token is not yet valid (%"
                    APR_INT64_T_FMT " > %" APR_TIME_T_FMT ") for URI '%s'",
                    nbf, apr_time_sec(now), r->uri);
            return AUTHT_INVALID;
        }
    }

    /* we are good at this point - accept the token */

    if (sub) {
        r->user = apr_pstrdup(r->pool, sub);
    }

    /* second pass - add all string claims to the environment, prefixed by TOKEN_ */
    kv = apr_json_object_first(jose->jose.jwt->claims);
    do {
        char *key, *val;
        int j;

        /* ignore anything that isn't a string */
        if (kv->k->type != APR_JSON_STRING || kv->v->type != APR_JSON_STRING) {
            continue;
        }

        key = apr_psprintf(r->pool, AUTHT_PREFIX "%.*s", (int)kv->k->value.string.len, kv->k->value.string.p);
        j = sizeof(AUTHT_PREFIX);
        while (key[j]) {
            if (apr_isalnum(key[j])) {
                key[j] = apr_toupper(key[j]);
            }
            else {
                key[j] = '_';
            }
            j++;
        }

        val = apr_pstrndup(r->pool, kv->v->value.string.p,
                kv->v->value.string.len);

        apr_table_setn(e, key, val);

    } while ((kv = apr_json_object_next(jose->jose.jwt->claims, kv)));

    return AUTHT_GRANTED;
}

static const autht_provider autht_jwt_provider =
{
    &check_token
};

static void register_hooks(apr_pool_t *p)
{
    ap_register_auth_provider(p, AUTHT_PROVIDER_GROUP, "jwt",
                              AUTHT_PROVIDER_VERSION,
                              &autht_jwt_provider, AP_AUTH_INTERNAL_PER_CONF);
    ap_hook_expr_lookup(jwt_expr_lookup, NULL, NULL, APR_HOOK_MIDDLE);
    ap_hook_post_config(auth_bearer_init, NULL, NULL, APR_HOOK_LAST);
}

AP_DECLARE_MODULE(autht_jwt) =
{
    STANDARD20_MODULE_STUFF,
    create_auth_bearer_dir_config,  /* dir config creater */
    merge_auth_bearer_dir_config,   /* dir merger --- default is to override */
    create_auth_bearer_config,      /* server config */
    merge_auth_bearer_config,       /* merge server config */
    auth_bearer_cmds,               /* command apr_table_t */
    register_hooks                  /* register hooks */
};

#else

static const command_rec auth_bearer_cmds[] =
{
    {NULL}
};

static void register_hooks(apr_pool_t *p)
{
}

AP_DECLARE_MODULE(autht_jwt) =
{
    STANDARD20_MODULE_STUFF,
    NULL,                           /* dir config creater */
    NULL,                           /* dir merger --- default is to override */
    NULL,                           /* server config */
    NULL,                           /* merge server config */
    auth_bearer_cmds,               /* command apr_table_t */
    register_hooks                  /* register hooks */
};

#endif /* HAVE_APU_JOSE */