# Authelia JWT Signing - Simple Setup

Minimal Authelia Docker setup focused on JWT signing with OIDC.

## 🎯 What This Does

- Issues JWT ID tokens
- Signs tokens with RSA keys
- Provides JWKS endpoint for verification
- Simple user authentication
- OIDC authorization code flow

## 🚀 Quick Start

```bash
# 1. Generate secrets and keys
./setup.sh

# 2. Update config.yml with RSA keys
#    Copy from RSA_KEYS.txt into config.yml

# 3. Start Authelia
docker-compose up -d

# 4. Test
curl -k https://localhost:9091/api/health
```

## 📝 Manual Setup

If you prefer manual setup:

### 1. Generate Secrets

```bash
mkdir -p secrets certs

# Generate secrets
openssl rand -hex 32 > secrets/jwt_secret
openssl rand -hex 32 > secrets/session_secret
openssl rand -base64 64 | tr -d '\n' > secrets/storage_encryption_key
openssl rand -hex 32 > secrets/oidc_hmac_secret
```

### 2. Generate Certificates

```bash
# TLS certificate for HTTPS
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout certs/authelia.key \
    -out certs/authelia.crt \
    -subj "/CN=localhost"

# RSA keys for JWT signing
openssl genrsa -out certs/rsa.2048.key 2048
openssl req -new -x509 -key certs/rsa.2048.key -out certs/rsa.2048.cert -days 365 \
    -subj "/CN=authelia-jwt"
```

### 3. Update config.yml

Replace these sections:

```yaml
# Replace HMAC secret
hmac_secret: <content from secrets/oidc_hmac_secret>

# Replace JWKS section with generated keys
jwks:
  - key_id: 'main-signing-key'
    algorithm: 'RS256'
    use: 'sig'
    key: |
      <content from certs/rsa.2048.key>
    certificate_chain: |
      <content from certs/rsa.2048.cert>
```

### 4. Start Authelia

```bash
docker-compose up -d
```

## ✅ Testing JWT Signing

### Test JWKS Endpoint

```bash
curl -k https://localhost:9091/jwks.json
```

Expected response:
```json
{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "kid": "main-signing-key",
      "alg": "RS256",
      "n": "...",
      "e": "AQAB"
    }
  ]
}
```

### Test OIDC Discovery

```bash
curl -k https://localhost:9091/.well-known/openid-configuration
```

Shows all OIDC endpoints including:
- `authorization_endpoint`
- `token_endpoint`
- `jwks_uri`

### Get JWT Token (Manual Flow)

1. **Get authorization code:**

Open browser:
```
https://localhost:9091/api/oidc/authorization?client_id=test-client&redirect_uri=http://localhost:8080/callback&response_type=code&scope=openid%20email%20profile&state=test
```

2. **Login:** admin / password123

3. **Copy authorization code** from redirect URL

4. **Exchange for token:**
```bash
curl -k -X POST https://localhost:9091/api/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=YOUR_AUTH_CODE" \
  -d "redirect_uri=http://localhost:8080/callback" \
  -d "client_id=test-client" \
  -d "code_verifier=YOUR_PKCE_VERIFIER"
```

Response includes signed JWT `id_token`.

### Verify JWT Token

Use https://jwt.io to decode and verify the token:
- Header shows `RS256` algorithm
- Payload shows user claims
- Signature verified with public key from JWKS

## 📊 Endpoints

| Endpoint | Purpose |
|----------|---------|
| `/api/health` | Health check |
| `/.well-known/openid-configuration` | OIDC discovery |
| `/jwks.json` | Public keys (JWKS) |
| `/api/oidc/authorization` | Authorization endpoint |
| `/api/oidc/token` | Token endpoint |
| `/api/oidc/userinfo` | User info endpoint |

## 👤 Default User

- **Username:** admin
- **Password:** password123
- **Email:** admin@localhost

## 🔧 Configuration

### Add More Users

Edit `users.yml`:

```yaml
users:
  newuser:
    displayname: "New User"
    password: "$argon2id$v=19$..." # Generate with docker command
    email: newuser@localhost
    groups:
      - users
```

Generate password hash:
```bash
docker run --rm authelia/authelia \
  authelia crypto hash generate argon2 --password 'MyPassword'
```

### Add More OIDC Clients

Edit `config.yml` under `clients`:

```yaml
clients:
  - client_id: my-app
    client_name: "My Application"
    public: true
    audience:
      - my-app
    redirect_uris:
      - http://localhost:3000/callback
    scopes:
      - openid
      - profile
      - email
```

## 🐛 Troubleshooting

### Container won't start

```bash
# Check logs
docker-compose logs authelia

# Common issues:
# - Invalid YAML in config.yml
# - Missing secrets files
# - Port 9091 already in use
```

### JWKS endpoint empty

```bash
# Ensure RSA keys are in config.yml
cat config.yml | grep -A 10 "jwks:"

# Restart container
docker-compose restart authelia
```

### Can't login

```bash
# Verify user exists
docker exec authelia cat /config/users_database.yml

# Check logs
docker-compose logs authelia | grep -i auth
```

## 📁 Files

```
authelia-jwt-simple/
├── docker-compose.yml    # Docker configuration
├── config.yml           # Authelia configuration
├── users.yml           # User database
├── setup.sh            # Setup script
├── secrets/            # Generated secrets (gitignore)
├── certs/             # Generated certificates (gitignore)
└── README.md          # This file
```

## 🔒 Security Notes

**For Testing:**
- Self-signed certificates
- Simple password
- All services on localhost

**For Production:**
- Use real SSL certificates (Let's Encrypt)
- Strong passwords
- Proper domain configuration
- Enable 2FA (TOTP)
- Use PostgreSQL instead of SQLite
- Secure secret storage

## 🎯 Use Cases

This setup is perfect for:
- Testing JWT signing
- OIDC integration development
- Learning OIDC flows
- OpenZiti external auth
- Application authentication

## 📚 Additional Resources

- [Authelia Docs](https://www.authelia.com/)
- [OIDC Specification](https://openid.net/specs/openid-connect-core-1_0.html)
- [JWT.io](https://jwt.io) - Decode tokens
- [JWKS Format](https://datatracker.ietf.org/doc/html/rfc7517)

## 💡 Quick Commands

```bash
# Start
docker-compose up -d

# Stop
docker-compose down

# Logs
docker-compose logs -f

# Restart
docker-compose restart

# Shell access
docker exec -it authelia sh

# View config
docker exec authelia cat /config/configuration.yml

# Test health
curl -k https://localhost:9091/api/health

# Get JWKS
curl -k https://localhost:9091/jwks.json

# OIDC discovery
curl -k https://localhost:9091/.well-known/openid-configuration
```

---

**Simple, focused, ready to sign JWTs!** 🔐