Problem configuring azure event grid JWT authentication

Question

I am trying to configure Azure Event Grid's JWT authentication. My tokens are coming from auth0 and I need Event Grid to validate them against the auth0 certificate. Now when I download the certificate from auth0 it only includes the public key (which should be just enough to validate the tokens). But when trying to upload the same certificate to Key Vault, it does not accept it from me because it does not contain the private key. How can I get around this issue?

Accepted Answer

@Mohammad Alinia ,

Welcome to the Microsoft Q&A!

Thanks for the patience! Following up on your question regarding JWT token validation with Azure Event Grid Namespace, I've received confirmation from our Event Grid SME team.

Azure Event Grid Namespace offers the ability to validate JWT tokens using custom settings. Specifically, you can provide your public key for validation using the CustomJwtAuthenticationSettings. This is available via the Azure CLI and the 2024-12-15-preview API version.

There are two options for providing the certificate information:

Using Azure Key Vault (AKV): You can reference certificates stored in AKV by providing the certificate URL and a managed identity.

Providing the Public Key Directly (Non-AKV): You can directly provide the public key in PEM format. This is the option you were inquiring about.

Here's a snippet illustrating both options:

"customJwtAuthentication": {
  "tokenIssuer": "issuer-name",
  // AKV option
  "issuerCertificates": [
    {
      "certificateUrl": "",
      "identity": {
        "type": "SystemAssigned"
      }
    }
  ],
  // Non-AKV option for specifying certificates with public key
  "encodedIssuerCertificates": [
    {
      "kid": "key1",
      "encodedCertificate": ""
    }
  ]
}

As you can see, the encodedIssuerCertificates array allows you to specify the public key directly using the encodedCertificate field (PEM format) and associate it with a key ID (kid).

For more details, you can refer to the official documentation: Namespaces - Create Or Update - REST API (Azure Event Grid) | Microsoft Learn

Please let me know if you have any further questions.

Answer

Hello Mohammad Alinia,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having problem configuring azure event grid JWT authentication.

Check the following steps:

Auth0 provides a JSON Web Key Set (JWKS) endpoint that contains the public keys needed for token validation and retrieve the JWKS URL from your Auth0 tenant under the "Advanced Settings" of the API or application.
Configure the Event Grid subscription to validate JWTs directly using the JWKS endpoint:
1. Go to the Azure Portal, navigate to your Event Grid subscription.
2. Under "Advanced Filters," select "Add Filter."
3. Choose "Token Validation" and provide the JWKS endpoint URL.
Convert the Auth0 public key to a format acceptable by Key Vault:
1. Auth0's public key is typically provided in PEM format. Convert it into a certificate using the following OpenSSL commands using bash:
```
            openssl req -new -x509 -keyout private.key -out auth0_cert.pem -days 365 -nodes
             openssl x509 -in auth0_cert.pem -pubkey -noout > auth0_public.pem
```
  The auth0_cert.pem file can now be uploaded to Azure Key Vault.
2. Upload the public key certificate to Key Vault:
  1. Navigate to the Key Vault in the Azure Portal.
  2. Select "Certificates" -> "Generate/Import" -> "Import."
  3. Upload the auth0_cert.pem file.
Configure Event Grid to use the uploaded certificate for JWT validation. Ensure the "Key Identifier" of the certificate matches the one expected in the tokens.

Read more of the following links to get more steps:

Verify the tokens using a tool like jwt.io to ensure the correct claims and signature are present. - https://zcusa.951200.xyz/en-us/azure/event-grid/authenticate-with-namespaces-using-json-web-tokens and https://zcusa.951200.xyz/en-us/azure/event-grid/oauth-json-web-token-authentication
Test the configuration by sending tokens to Event Grid and confirming successful validation. https://auth0.com/blog/integrate-azure-event-grid-with-auth0 and https://marketplace.auth0.com/integrations/azure-log-streaming
Ensure that the Key Vault certificate is set with appropriate access policies to allow Event Grid to use it for validation. https://zcusa.951200.xyz/en-us/azure/event-grid/auth0-how-to and https://zcusa.951200.xyz/en-us/answers/questions/2136304/problem-configuring-azure-event-grid-jwt-authentic

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

Problem configuring azure event grid JWT authentication

1 additional answer

Your answer